Host Based

How would you enumerate host-based data on a Windows Domain Controller?

• By using the DHCP console

• Through Active Directory Users and Computers

• By configuring the router

• Through DNS management

Answer explanation

The correct choice is 'Through Active Directory Users and Computers' because this tool allows you to manage and enumerate host-based data, including user accounts and computer objects in a Windows Domain Controller.

What is the purpose of system enumeration?

• To distribute IP addresses

• To list all user permissions and groups on a system

• To configure network devices

• To encrypt data transmissions

Answer explanation

System enumeration is used to list all user permissions and groups on a system, helping administrators understand access levels and security configurations. This is crucial for managing user rights effectively.

What is a common first step in the digital forensic process when dealing with volatile memory?

• Backing up the hard drive

• Capturing system logs

• Imaging the RAM

• Reviewing user permission

Answer explanation

Imaging the RAM is crucial as volatile memory contains data that is lost when power is off. Capturing this data first allows forensic analysts to preserve evidence of running processes and system states.

Which tool can be used to analyze network traffic on a Windows Domain Controller?

• Registry Editor

• Event Viewer

• Task Manager

• Wireshark

Answer explanation

Wireshark is a powerful tool specifically designed for analyzing network traffic, making it the correct choice for monitoring data on a Windows Domain Controller. The other options serve different purposes.

What is the primary purpose of capturing a disk image in digital forensics?

• To create a backup for disaster recovery

• To update system software

• To preserve evidence for analysis

• To increase system performance

Answer explanation

The primary purpose of capturing a disk image in digital forensics is to preserve evidence for analysis. This ensures that the original data remains intact and unaltered, allowing for accurate examination and investigation.

Which protocol is commonly used for secure remote access to a Windows server?

• FTP

• SSH

• RDP

• HTTP

Answer explanation

RDP (Remote Desktop Protocol) is specifically designed for secure remote access to Windows servers, allowing users to connect and control their desktops remotely. Other options like FTP and HTTP do not provide secure remote access.

Which tool can help anticipate degraded performance and other system issues?

• Network monitor

• SIEM system

• Performance monitor

• Dashboard application

What is the first step in collecting a digital forensic image?

• Analyzing the image for malware

• Making a copy of all logs

• Ensuring the integrity of the data

• Deleting old data from the storage

On a 64-bit Windows platform, where are 32-bit applications typically installed?

• C:\Program Files\

• C:\Program Files (x86)\

• C:\Windows\System32\

• C:\Windows\SysWOW64

Which tool is typically used for performing vulnerability assessments in a network?

• Nessus

• Wireshark

• DHCP server

• DNS server