WorksheetsCISSP Quiz
Total questions: 60
Worksheet time: 44mins
A fundamental difference between how a Static lab and a Dynamic lab is configured is that the dynamic lab should be malware
(a)
A fundamental difference between how a Static lab and Dynamic lab is configured is that the static lab should be more
(a)
Malware Friendly:
One of the goals in configuring a dynamic lab PC is to make it "friendly" to malware
True
False
Hyper-V:
Which of the following is the best reason why Hyper-V is not the best choice for running older guest operating systems (like Windows XP)
Because Hyper-V is a "Type 2" hypervisor
There may be problems with driver support and "virutalization additions"
Because Window XP is not secure
Because Hyper-V is a "Type 1" hypervisor
Browsers:
You should install many browsers in your Dynamic Lab PC
True
False
Exploited Software:
Which of the following are some of the commonly exploited software that should be installed in a Dynamic Lab PC
Note: Multiple answers may apply
Notepad++
Microsoft Office
Adobe Flash player
Adobe Acrobat reader
A 3rd-party anti-virus package
Enticing Files:
When creating enticing files, you just need to use creative file names... there's no need for any actual content for the files
True
False
When setting up a dynamic lab one should avoid using their real social media accounts because their identity should remain
(a)
Browser Fingerprint:
Which of the following items can be easily discovered about your PC's browser from a web site
Note: Multiple answers may apply
External IP Address
PC NetBIOS name
General Location
Screen resolution
Language
The fundamental purpose for "anonymizing" the Dynamic Lab PC is to prevent
(a)
Transfer Files:
Best/safest way to transfer files from a host PC to a guest PC in VirtualBox is to
(a)
VM Restore:
Which of the following are the best techniques for restoring a VirtualBox VM back to its original state
Note: Multiple answers may apply
Use a "seed" disk
Use an "Immutable Image"
Use a screenshot
Use a snapshot
Backup:
Which of the following possible backup utilities are free to use in a virtual environment
Note: Multiple Answers Apply
Backup Exec
Clonezilla
Bugzilla
Macrium Reflect
Acronis True Image
A clean slate allows one to conduct analysis without
(a)
Bare-Metal Restore:
There is no practical way to restore a bare-metal PC to a "clean slate" other than just reimaging the PC
True
False
Cookies:
A "web cookie" can be used as a vector for malware
True
False
Blocking:
It is considered good practice to block all cookies on your Dynamic Lab PC
True
False
Tools:
Which application was used to monitor the real-time file and registry activity of the NotePad v5 demo
ILspy
ProcMon
ProcExp
ProcDump
To view file locations a program is writing to when it uses a random generator one must run the application in a
(a)
DLL:
You can easily execute a DLL file from the command line (just like an EXE file)
True
Fale
Drivers:
Windows driver files (*.DRV) use a different file format from DLLs
True
False
Concerning DLLs, "load on demand" means these resources, the DLLs, will only be loaded into memory if and when they are
(a)
DOS Stub:
When launching a WinPE from the Windows 10 command prompt (cmd.exe), you will just get a message that says "This program cannot be run in DOS mode"
True
False
PE Format:
From which of the following parts of the WinPE file format will you find if the file is an EXE or DLL
PE Signature
Image File Header
Image Optional Header
Section Table
None of the above
PE Format:
From which of the following parts of the WinPE file format will you find if the file is a Graphical User Interface (GUI) or CommandLine User Interface (CUI)
PE Signature
Image File Header
Image Optional Header
Section Table
None of the above
PE Sections:
Which of the following possible section names is where Microsoft stores the actual executable "code"
.code
.data
.reloc
.edata
None of the above
To mitigate exploitation of the well-known starting address vulnerability through a buffer overflow one can use
(a)
Exports Section:
A typical EXE file will not have any exported functions
True
False
Stepping through a program with a debugger like DnSpy can help one to see clear
(a)
Analysis:
When dealing with an unknown file, it makes sense to analyze it first before making the decision to protect it during its "life cycle"
True
False
State:
Which of the following is an example of a non-executable state
Georgia
Encryption
Compression
Changing the file extension
Zip File:
Although you can not create a password-protected zip file using just Windows 10, you can use a password-protected zip file
True
False
To prevent e-mail scanners from scanner the attachment that contains your malware you can send the malware in a password
(a)
A PKI can allows users to secure their communications by sharing keys that support asymmetrical encryption and
(a)
Digital Signature:
The two major purposes of a digital signature on a file is to verify who originally created (or signed) the file and that it has not changed since the signature
True
False
CIA Triangle:
Which of the following are the 3 parts of the CIA triangle
Note: I'm expecting that you'd select exactly 3
Confidentiality
Control
Authentication
Integrity
Availability
Redundancy:
Having hardware redundancy such as RAID, is mostly associated with which part of the CIA triangle
Note: There could be more than 1 answer, so pick the most significant one
(a)
User Errors:
Which part of the CIA triangle deals with potential User Errors (like accidentially deleting a file)
(a)
A RAID 5 implementation with 6 drives has a volume size of how many TB?
(a)
A RAID 0 implementation with 2 drives results in a volume size of how many TB?
(a)
Researchers normally create a unique identifier for each malware sample for classification and
(a)
Packer:
What is the major purpose for using a "packer" in the context of chapter 11
Note: More than one may be true, so pick the best!
A fan of the Green Bay Packers
A software component that can be used to protect intellectual property
A software component used to reduce executable sizes
A software component used to encrypt a file
A software component that makes Static analysis more difficult
PEid:
Determining the type of packer used on a file is necessary to do this to a file.
(a)
On-Line Scanning:
Which of the following are advantages of using on-line malware scanning
Note: Multiple answers may apply
You don't have to keep the AV definitions up to date
has a better record of minimizing false positives
results are shared with AV researchers and vendors
has a better record of minimizing false negatives
UPX:
The UPX packer can be easily configured to work with EXE files produced from .Net Assemblies
True
False
The point of a malware author's attempt to create a malformed PE structure is to do this to tools that can be used for analysis.
(a)
SysInternals:
Which of the following System Internals tools can be used to display the "string" data in an EXE
Extract
ProcExp
Strings
ProcDump
Hex2Dec
One can display the "clear text" version of encrypted strings in an EXE with a debugger like
(a)
Dynamic Analysis:
Dynamic analysis is typically required since Static is less likely to reveal the "directive"
True
False
Virtual Lab:
One should use both a Virtual Lab environment and a "bare metal" environment because malware may be able to ... the environment they are being run in.
(a)
Installation:
One may be able to monitor the installation of malware by viewing host behavior with a program called
(a)
Persistency:
One may be able to determine if a malware has achieved persistence on a machine by examining host behavior with a program called
(a)
Downloaders:
Malware that uses downloaders are typically smaller EXE files than their Dropper counterparts
True
False
Droppers:
Droppers aren't that successful these days, since the use of User Account Control (UAC) became prevalent
True
False
Persistency:
Which tool is helpful in discovering the "persistency" of malware
ILSpy
ProcMon
Autoruns
ProcExp
dnSpy
Common Locations:
Which of the following locations require admin rights to be able to copy new files
Note: Multiple answers may apply
C:\Windows folder
C:\Windows\Temp folder
Your folder under C:\Users folder
C:\Windows\System folder
Survival:
Which of the following techniques for ensuring survival after a shutdown or reboot do not require admin permissions to perform
Note: Multiple answers may apply
Hijacking the boot sector
Infecting system files
Adding the malware in the StartUp folder
Utilizing Task Scheduler
Utilizing the registry
Malware authors often design their malware to be hidden files or folders. So, one should configure their file explorer to show
Note: Many may apply
hidden files
system folder
file extensions
DLLs
RootKit:
A RootKit is able to hide files by doing this to API calls.
(a)
PKI:
Consider a scenario where you want to send an encrypted email to another person at your company. Which key will be used
My private key
My public key
Their private key
Their public key
