Define the CSIRT Acronym - ANSWER- Computer Security Incident Response
Team
Let's build an IR team, whom do we need? - ANSWER- A. Analyst - Does ALL of
the work.
B. IR Manager - Manages up, helps herd the cats, removes blockers.
C. Researcher - Malware analysis, digs into vulnerabilities, etc.
What types of things do we do in Digital Forensics? - ANSWER- A. Collecting
information - collecting artifacts to analyze.
B. Examining artifacts - looking for malware and signs of compromise.
C. Reporting - we write comprehensive technical reports.
Which of the following is a digital forensic method?
A. Deleting files
B. Steganography
C. Live analysis
D. All the above - ANSWER- C. Live analysis
What is the order of the IR lifecycle? - ANSWER- Preparation, Detection and
Analysis, Containment, Eradication and Recovery, and Post Incident Activity.
Note: No 'identification', 'termination'
Which of the following tools can interface with Windows OS and a RAM dump?
A. CAINE
(Computer aided investigation Environment)
B. Volatility
C. Wireshark
(Protocol analyzer)
D. SIFT
(SANS incident) - ANSWER- B. Volatility
How can malware be detected?