DIFR Exam Review

What is the responsibility of a CISO?

• To make sure the physical security of an organization is sufficient

• To create a strategy for data and IT asset protection and maintain it

• To manage IT employees and search for quality recruits

• To manage the business model of an organization

Which of the following is not a containment strategy for a cybersecurity incident?

• Blocklist filtering

• Host isolation

• Updating IDS rules

• Segmentation of networks

Which of the following is not included in the digital forensics process?

• Penetration Testing

• Collection

• Examination

• Reporting

Which of the following is not a tool that is used for data carving?

• DumpIt

• HxD

• PhotoRec

• Bulk Extractor

Which of the following is the correct order of the NIST incident response process?

• Identification, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity

• Identification, Detection and Analysis, Containment, Termination, Recovery, and Post-Incident Activity

• Preparation, Detection and Analysis, Containment, Termination, Recovery, and Post-Incident Activity

• Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity

Which of the following tools can be used to research RAM dumps?

• PhotoRec

• Volatility

• dd

• Exif tool

Which of the following should be monitored during dynamic malware analysis? (Choose all correct answers.)

• File System Changes

• Network Activity

• Registry Changes

• Executable File Strings

What is a sandbox used for?

• To perform static malware analysis

• To test malware in an isolated environment

• To run new apps

• To clear infected files in the host system

What is the difference between Wireshark and tcpdump?

• tcpdump is command-based; Wireshark has a GUI interface.

• tcpdump can only capture packets that use TCP.

• Wireshark is a network monitoring tool; tcpdump is used as an IDS.

• tcpdump is a dumping tool; Wireshark monitors system files.

Which of the following is not a feature of Wireshark?

• Display filters

• Replace network traffic

• Stream inspection

• Object export