DFIR

What does DFIR stand for?

• • Digital Forensics and Incident Response

• Digital Framework and Information Response

• Data Forensics and Incident Recovery

• Digital Forensics and Incident Recovery

What is the first step in the IR lifecycle according to SANS?

• • Containment

• • Preparation

• • Eradication

• Detection

What is digital evidence?

• Any physical evidence collected from a crime scene

• • Any data collected from digital devices such as computers

• Any testimony given in court

• Any document written by hand

Why is the scoping phase critical in the digital forensics lifecycle?

• • It documents findings and conclusions

• It identifies the goals, limitations, and boundaries of the investigation

• It involves preserving digital evidence

• It organizes collected data for analysis

During containment, what must be done to compromised systems to prevent more damage?

• Allow full access to compromised systems.
• Ignore the compromised systems entirely.
• Power off the compromised systems immediately.

• Isolate and quarantine the compromised systems.

The making of a bit-by-bit copy of forensic data is known as?

• Imaging
• Transferring
• Backing up
• Cloning

Which sources of evidence are the most volatile on a host?

• CPU registers and cache

• Temporary File Systems

• Remote Logging and Monitoring Data

• RAM

Which approach in digital forensics involves extracting meaningful data from unallocated space?

• Data Carving

• Data Parsing

• Data Analysis

• Data Encryption

Which tool is often used for indexing and searching large volumes of log data?

• Sigma

• FTK Imager

• ElasticSearch/OpenSearch

• Autopsy

What is triage data primarily used for in DFIR?

• Detailed analysis and reporting of an entire system

• Quickly assessing the scope and severity of an incident

• Preserving all evidence for long-term storage

• Identifying and mitigating active threats in real-time