Back to Subject

Unit 4: Linux and Network Forensics - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 Which directory in the Linux file system is a virtual file system containing volatile information about running processes and system resources?

A. /var
B. /etc
C. /proc
D. /home

2 Which Linux command is primarily used to list open files and the processes that opened them, crucial for analyzing volatile data?

A. lsof
B. grep
C. chmod
D. ls

3 In Linux forensics, what does the 'w' command display?

A. The wireless network strength
B. A list of logged-in users and what they are doing
C. Write permissions of the current directory
D. Network interface configuration

4 Which of the following data is considered Non-volatile in a Linux system?

A. RAM contents
B. Running process list
C. System logs stored in /var/log
D. ARP cache

5 What is the primary purpose of the Linux Swap space in the context of forensics?

A. To store the master boot record
B. To act as an extension of RAM, potentially containing volatile memory artifacts
C. To store user passwords permanently
D. To keep network logs

6 Which command-line utility is commonly used to create a bit-stream image of a Linux partition?

A. mv
B. dd
C. tar
D. cp

7 What is an Inode in the context of Linux file systems?

A. The name of the root user
B. A networking protocol
C. A data structure storing metadata about a file (size, owner, permissions)
D. An input node for peripherals

8 When analyzing a Linux file system image, what does a dot (.) at the beginning of a filename indicate?

A. The file is corrupted
B. The file is a directory
C. The file is hidden
D. The file is an executable

9 Which file system is the default journaling file system for many modern Linux distributions?

A. ext4
B. NTFS
C. HFS+
D. FAT32

10 Which file in Linux contains encrypted user passwords?

A. /etc/shadow
B. /etc/passwd
C. /etc/group
D. /var/www

11 Which tool is a Loadable Kernel Module (LKM) often used to acquire volatile memory from Linux systems?

A. Autopsy
B. LiME
C. Wireshark
D. Nmap

12 Why is Memory Forensics critical in investigating advanced malware?

A. Malware may reside only in RAM (fileless) or encrypt its disk components
B. Malware always deletes itself from the disk immediately
C. RAM is easier to copy than a hard drive
D. Memory forensics is faster than disk forensics

13 Which framework is the industry standard for analyzing volatile memory dumps?

A. Metasploit
B. John the Ripper
C. Volatility
D. Snort

14 In the context of Volatility, what is a 'profile'?

A. The hardware configuration of the suspect machine
B. A list of suspect IP addresses
C. A specification of the operating system version and kernel data structures
D. The user account of the investigator

15 Which command in the Volatility framework is used to list running processes from a memory dump?

A. linux_pslist
B. linux_ls
C. linux_netstat
D. linux_mount

16 What artifact can often be recovered from memory that allows an investigator to decrypt encrypted volumes?

A. The BIOS password
B. The Master Boot Record
C. The MAC address
D. Encryption Keys

17 What is Network Forensics?

A. Repairing broken routers
B. Cracking Wi-Fi passwords
C. Restoring deleted emails
D. Monitoring and analyzing computer network traffic for information gathering, legal evidence, or intrusion detection

18 Which mode must a network interface card (NIC) be in to capture all traffic on a network segment, not just traffic addressed to it?

A. Safe mode
B. Protected mode
C. Promiscuous mode
D. Private mode

19 In the 'Catch-it-as-you-can' network forensics strategy, what is the main challenge?

A. It requires large amounts of storage to keep all captured data
B. It is illegal in most countries
C. It misses data frequently
D. It cannot capture encrypted traffic

20 Which of the following is a standard format for saving captured network packets?

A. JPEG
B. PCAP
C. DOCX
D. PDF

21 What is 'Forensic Readiness' regarding network logging?

A. Having a lawyer on speed dial
B. Buying the most expensive forensic software
C. The ability to maximize an organization's potential to use digital evidence while minimizing the cost of an investigation
D. Deleting logs every 24 hours to save space

22 Which Linux log file typically records authentication information, such as failed login attempts?

A. /var/log/kern.log
B. /var/log/boot.log
C. /var/log/dmesg
D. /var/log/auth.log

23 What is the standard port for the Syslog protocol?

A. 80
B. 443
C. 514
D. 22

24 Which protocol is crucial for ensuring that timestamps across different network devices are consistent for correlation?

A. HTTP
B. NTP
C. SMTP
D. FTP

25 What does the term 'Log Rotation' refer to?

A. Encrypting logs using a rotating cipher
B. The process of archiving old log files and creating new ones to prevent file systems from filling up
C. Sending logs to different servers in a round-robin fashion
D. Spinning the hard drive physically

26 Which syslog severity level indicates the system is unusable?

A. Info (6)
B. Warning (4)
C. Debug (7)
D. Emergency (0)

27 What is 'Event Correlation' in the context of network forensics?

A. Copying events from one log to another
B. Relating distinct events from multiple sources to identify a pattern or security incident
C. Deleting duplicate events
D. Backing up events to the cloud

28 In event correlation, what is 'Normalization'?

A. Converting data from different formats into a common format for analysis
B. Making all users use the same password
C. Ignoring outliers in data
D. Reducing the severity of all alerts

29 What is a SIEM system used for?

A. Simple Internet Evidence Monitor
B. Security Information and Event Management
C. Secure Internal External Messaging
D. System Information and Email Management

30 What is an Indicator of Compromise (IoC)?

A. A password policy
B. A type of network cable
C. A software license key
D. A piece of forensic data that identifies potentially malicious activity on a system or network

31 Which of the following is a common Network IoC?

A. A blue screen of death
B. Beaconing traffic to a known malicious IP address
C. High CPU usage on a local machine
D. A fragmented hard drive

32 What is 'Beaconing' in network traffic analysis?

A. The blinking light on a network card
B. A router broadcasting its SSID
C. Sending a distress signal to the administrator
D. Malware sending regular communications to a Command and Control (C2) server

33 What does a sudden spike in outbound traffic likely indicate?

A. A system update
B. A failed login attempt
C. Data Exfiltration
D. Incoming email

34 Which User-Agent string anomaly might indicate a non-browser tool or malware?

A. Python-urllib/3.8
B. Chrome/91.0.4472.124
C. Mozilla/5.0 (Windows NT 10.0; Win64; x64)
D. Safari/537.36

35 What is a Domain Generation Algorithm (DGA) used for by malware?

A. To speed up DNS resolution
B. To periodically generate a large number of domain names for C2 communication to evade blacklisting
C. To encrypt the hard drive
D. To generate secure passwords

36 Which tool is primarily used for deep packet analysis and visual inspection of traffic?

A. Traceroute
B. Ping
C. Wireshark
D. Netcat

37 Which command-line packet analyzer is standard on most Unix-like systems?

A. Tcpdump
B. Excel
C. Outlook
D. Photoshop

38 What Wireshark display filter would show only traffic associated with IP address 192.168.1.5?

A. ip = 192.168.1.5
B. ip.addr == 192.168.1.5
C. filter.ip(192.168.1.5)
D. show 192.168.1.5

39 In a TCP packet, which flag initiates a connection?

A. FIN
B. RST
C. ACK
D. SYN

40 What traffic pattern is characteristic of a SYN Flood DoS attack?

A. Large UDP packets
B. Many connection requests (SYN) without completing the handshake (ACK)
C. Slow HTTP requests
D. Many FIN packets sent at once

41 How does Deep Packet Inspection (DPI) differ from stateful inspection?

A. It only works on wireless networks
B. It only looks at the header
C. It is faster but less secure
D. It examines the data part (payload) of the packet as well as the header

42 Which of the following creates a significant challenge for network traffic investigation?

A. IPv4 addressing
B. DHCP
C. Ethernet cables
D. End-to-End Encryption (TLS/SSL)

43 What is the function of the command grep in Linux forensics?

A. To format a disk
B. To capture packets
C. To restart the system
D. To search text or logs for specific patterns or strings

44 Which directory contains configuration files in Linux, useful for establishing the baseline state of a system?

A. /dev
B. /bin
C. /tmp
D. /etc

45 In network forensics, what is the 'fast-flux' technique?

A. A way to speed up internet download speeds
B. Using fiber optics instead of copper
C. Rapidly plugging and unplugging network cables
D. A DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts

46 Which log file would you check to investigate potential USB device insertions on a Linux system?

A. /var/log/apache2/access.log
B. /var/log/mail.log
C. /var/log/dpkg.log
D. /var/log/kern.log

47 What is the primary benefit of 'Centralized Logging'?

A. It is cheaper than local logging
B. It prevents an attacker from deleting logs locally to cover their tracks
C. It requires no configuration
D. It uses less bandwidth

48 Which command displays the history of commands executed by the current user?

A. mem
B. history
C. trace
D. past

49 What does a 'Keep-Alive' signal usually suggest in a forensic analysis of malware?

A. The malware is maintaining an active connection to the C2 server to receive commands
B. The network cable is unplugged
C. The computer battery is low
D. The firewall is blocking traffic

50 When analyzing a disk image, which hashing algorithm is commonly used to verify the integrity of the image?

A. SHA-256
B. DES
C. AES
D. RSA
Previous MCQ
Unit 3
Next MCQ
Unit 5