Back to Subject

Unit 4: Linux and Network Forensics - Practice Quiz

INT250 — Digital Evidence Analysis 50 Questions
0 Correct 0 Wrong 50 Left
0/50

1 Which directory in the Linux file system is a virtual file system containing volatile information about running processes and system resources?

A. /var
B. /home
C. /proc
D. /etc

2 Which Linux command is primarily used to list open files and the processes that opened them, crucial for analyzing volatile data?

A. ls
B. chmod
C. lsof
D. grep

3 In Linux forensics, what does the 'w' command display?

A. The wireless network strength
B. Write permissions of the current directory
C. Network interface configuration
D. A list of logged-in users and what they are doing

4 Which of the following data is considered Non-volatile in a Linux system?

A. System logs stored in /var/log
B. ARP cache
C. RAM contents
D. Running process list

5 What is the primary purpose of the Linux Swap space in the context of forensics?

A. To store user passwords permanently
B. To keep network logs
C. To act as an extension of RAM, potentially containing volatile memory artifacts
D. To store the master boot record

6 Which command-line utility is commonly used to create a bit-stream image of a Linux partition?

A. dd
B. tar
C. mv
D. cp

7 What is an Inode in the context of Linux file systems?

A. A networking protocol
B. An input node for peripherals
C. The name of the root user
D. A data structure storing metadata about a file (size, owner, permissions)

8 When analyzing a Linux file system image, what does a dot (.) at the beginning of a filename indicate?

A. The file is a directory
B. The file is an executable
C. The file is hidden
D. The file is corrupted

9 Which file system is the default journaling file system for many modern Linux distributions?

A. ext4
B. HFS+
C. NTFS
D. FAT32

10 Which file in Linux contains encrypted user passwords?

A. /etc/shadow
B. /etc/passwd
C. /etc/group
D. /var/www

11 Which tool is a Loadable Kernel Module (LKM) often used to acquire volatile memory from Linux systems?

A. LiME
B. Wireshark
C. Nmap
D. Autopsy

12 Why is Memory Forensics critical in investigating advanced malware?

A. Memory forensics is faster than disk forensics
B. RAM is easier to copy than a hard drive
C. Malware may reside only in RAM (fileless) or encrypt its disk components
D. Malware always deletes itself from the disk immediately

13 Which framework is the industry standard for analyzing volatile memory dumps?

A. Snort
B. Volatility
C. Metasploit
D. John the Ripper

14 In the context of Volatility, what is a 'profile'?

A. A list of suspect IP addresses
B. The user account of the investigator
C. A specification of the operating system version and kernel data structures
D. The hardware configuration of the suspect machine

15 Which command in the Volatility framework is used to list running processes from a memory dump?

A. linux_mount
B. linux_ls
C. linux_pslist
D. linux_netstat

16 What artifact can often be recovered from memory that allows an investigator to decrypt encrypted volumes?

A. The Master Boot Record
B. Encryption Keys
C. The MAC address
D. The BIOS password

17 What is Network Forensics?

A. Monitoring and analyzing computer network traffic for information gathering, legal evidence, or intrusion detection
B. Cracking Wi-Fi passwords
C. Repairing broken routers
D. Restoring deleted emails

18 Which mode must a network interface card (NIC) be in to capture all traffic on a network segment, not just traffic addressed to it?

A. Private mode
B. Safe mode
C. Protected mode
D. Promiscuous mode

19 In the 'Catch-it-as-you-can' network forensics strategy, what is the main challenge?

A. It cannot capture encrypted traffic
B. It requires large amounts of storage to keep all captured data
C. It is illegal in most countries
D. It misses data frequently

20 Which of the following is a standard format for saving captured network packets?

A. PCAP
B. JPEG
C. DOCX
D. PDF

21 What is 'Forensic Readiness' regarding network logging?

A. Deleting logs every 24 hours to save space
B. Buying the most expensive forensic software
C. Having a lawyer on speed dial
D. The ability to maximize an organization's potential to use digital evidence while minimizing the cost of an investigation

22 Which Linux log file typically records authentication information, such as failed login attempts?

A. /var/log/kern.log
B. /var/log/boot.log
C. /var/log/auth.log
D. /var/log/dmesg

23 What is the standard port for the Syslog protocol?

A. 514
B. 443
C. 22
D. 80

24 Which protocol is crucial for ensuring that timestamps across different network devices are consistent for correlation?

A. HTTP
B. NTP
C. SMTP
D. FTP

25 What does the term 'Log Rotation' refer to?

A. Spinning the hard drive physically
B. Sending logs to different servers in a round-robin fashion
C. Encrypting logs using a rotating cipher
D. The process of archiving old log files and creating new ones to prevent file systems from filling up

26 Which syslog severity level indicates the system is unusable?

A. Emergency (0)
B. Debug (7)
C. Info (6)
D. Warning (4)

27 What is 'Event Correlation' in the context of network forensics?

A. Copying events from one log to another
B. Deleting duplicate events
C. Backing up events to the cloud
D. Relating distinct events from multiple sources to identify a pattern or security incident

28 In event correlation, what is 'Normalization'?

A. Converting data from different formats into a common format for analysis
B. Making all users use the same password
C. Ignoring outliers in data
D. Reducing the severity of all alerts

29 What is a SIEM system used for?

A. Simple Internet Evidence Monitor
B. Secure Internal External Messaging
C. System Information and Email Management
D. Security Information and Event Management

30 What is an Indicator of Compromise (IoC)?

A. A password policy
B. A type of network cable
C. A software license key
D. A piece of forensic data that identifies potentially malicious activity on a system or network

31 Which of the following is a common Network IoC?

A. A blue screen of death
B. Beaconing traffic to a known malicious IP address
C. A fragmented hard drive
D. High CPU usage on a local machine

32 What is 'Beaconing' in network traffic analysis?

A. The blinking light on a network card
B. A router broadcasting its SSID
C. Malware sending regular communications to a Command and Control (C2) server
D. Sending a distress signal to the administrator

33 What does a sudden spike in outbound traffic likely indicate?

A. A system update
B. A failed login attempt
C. Incoming email
D. Data Exfiltration

34 Which User-Agent string anomaly might indicate a non-browser tool or malware?

A. Chrome/91.0.4472.124
B. Mozilla/5.0 (Windows NT 10.0; Win64; x64)
C. Python-urllib/3.8
D. Safari/537.36

35 What is a Domain Generation Algorithm (DGA) used for by malware?

A. To generate secure passwords
B. To periodically generate a large number of domain names for C2 communication to evade blacklisting
C. To encrypt the hard drive
D. To speed up DNS resolution

36 Which tool is primarily used for deep packet analysis and visual inspection of traffic?

A. Traceroute
B. Wireshark
C. Ping
D. Netcat

37 Which command-line packet analyzer is standard on most Unix-like systems?

A. Photoshop
B. Outlook
C. Excel
D. Tcpdump

38 What Wireshark display filter would show only traffic associated with IP address 192.168.1.5?

A. ip = 192.168.1.5
B. filter.ip(192.168.1.5)
C. show 192.168.1.5
D. ip.addr == 192.168.1.5

39 In a TCP packet, which flag initiates a connection?

A. SYN
B. FIN
C. RST
D. ACK

40 What traffic pattern is characteristic of a SYN Flood DoS attack?

A. Large UDP packets
B. Many connection requests (SYN) without completing the handshake (ACK)
C. Many FIN packets sent at once
D. Slow HTTP requests

41 How does Deep Packet Inspection (DPI) differ from stateful inspection?

A. It is faster but less secure
B. It examines the data part (payload) of the packet as well as the header
C. It only works on wireless networks
D. It only looks at the header

42 Which of the following creates a significant challenge for network traffic investigation?

A. Ethernet cables
B. DHCP
C. IPv4 addressing
D. End-to-End Encryption (TLS/SSL)

43 What is the function of the command grep in Linux forensics?

A. To capture packets
B. To format a disk
C. To restart the system
D. To search text or logs for specific patterns or strings

44 Which directory contains configuration files in Linux, useful for establishing the baseline state of a system?

A. /etc
B. /dev
C. /tmp
D. /bin

45 In network forensics, what is the 'fast-flux' technique?

A. Using fiber optics instead of copper
B. Rapidly plugging and unplugging network cables
C. A way to speed up internet download speeds
D. A DNS technique used by botnets to hide phishing and malware delivery sites behind an ever-changing network of compromised hosts

46 Which log file would you check to investigate potential USB device insertions on a Linux system?

A. /var/log/dpkg.log
B. /var/log/mail.log
C. /var/log/kern.log
D. /var/log/apache2/access.log

47 What is the primary benefit of 'Centralized Logging'?

A. It requires no configuration
B. It prevents an attacker from deleting logs locally to cover their tracks
C. It uses less bandwidth
D. It is cheaper than local logging

48 Which command displays the history of commands executed by the current user?

A. history
B. mem
C. past
D. trace

49 What does a 'Keep-Alive' signal usually suggest in a forensic analysis of malware?

A. The network cable is unplugged
B. The computer battery is low
C. The malware is maintaining an active connection to the C2 server to receive commands
D. The firewall is blocking traffic

50 When analyzing a disk image, which hashing algorithm is commonly used to verify the integrity of the image?

A. RSA
B. DES
C. SHA-256
D. AES
Previous MCQ
Unit 3
Next MCQ
Unit 5