FiltersDone

Question type

Essay

Multiple Choice

Short Answer

True False

Matching

Exam 11: Virtual Machines, Network Forensics, and Live Acquisitions

Show Answer

Share

---

All types

Filters

Study FlashcardsPractice ExamLearn

Question 21

Short Answer

Review LaterAdd Note

Review Later

____________________ logs record traffic in and out of a network.

Correct Answer

verified

Show Answer

Question 22

Multiple Choice

Review LaterAdd Note

Review Later

____ is a suite of tools created by Sysinternals.

A) EnCase
B) PsTools
C) R-Tools
D) Knoppix

E) A) and D)
F) All of the above

Correct Answer

verified

Show Answer

Question 23

Multiple Choice

Review LaterAdd Note

Match each item with a statement below: -type of malware

____ is a Sysinternals command that shows all Registry data in real time on a Windows computer.

When intruders break into a network, they rarely leave a trail behind.

Detail a standard procedure for network forensics investigations.

____ is the text version of Ethereal, a packet sniffer tool.

Match each item with a statement below: -an audit control program that detects anomalies in traffic and sends an alert automatically

Explain The Auditor tool.

PsList from PsTools allows you to list detailed information about processes.

____ hide the most valuable data at the innermost part of the network.

____________________ is a layered network defense strategy developed by the National Security Agency (NSA).

How should you proceed if your network forensic investigation involves other companies?

The Knoppix STD tool ____ enables you to reset passwords on a Windows computer, including the administrator password

____ is a good tool for extracting information from large Libpcap files.

Match each item with a statement below: -a bootable Linux CD intended for computer and network forensics

Most packet sniffer tools can read anything captured in ____ format.

____ can help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program.

The U.K. Honeynet Project has created the ____________________. It contains the honeywall and honeypot on a bootable memory stick.

____ can be used to create a bootable forensic CD and perform a live acquisition.