Title: Module Three Quiz
Course: CAP 2141 Digital Forensics II > Section: Module 3 Virtual Machines, Network Forensics, and Live Acquisition

Q: ____ can be used to create a bootable forensic CD and perform a live acquisition.
- Helix
- DTDD
- Inquisitor
- Neon
A: Helix

Q: ____ forensics is the systematic tracking of incoming and outgoing traffic on your network.
- Network
- Computer
- Criminal
- Server
A: Network

Q: ____ hide the most valuable data at the innermost part of the network.
- Layered network defense strategies
- Firewalls
- Protocols
- NAT
A: Layered network defense strategies

Q: ____ can help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program.
- Broadcast forensics
- Network forensics
- Computer forensics
- Traffic forensics
A: Network forensics

Q: ____ is a Sysinternals command that shows all Registry data in real time on a Windows computer.
- PsReg
- RegExplorer
- RegMon
- RegHandle
A: RegMon

Q: ____ is a suite of tools created by Sysinternals.
- EnCase
- PsTools
- R-Tools
- Knoppix
A: PsTools

Q: A common way of examining network traffic is by running the ____ program.
- Netdump
- Slackdump
- Coredump
- Tcpdump
A: Tcpdump

Q: Helix operates in two modes:Windows Live (GUI or command line) and ____.
- command Windows
- remote GUI
- command Linux
- bootable Linux
A: bootable Linux

Q: The ____ Project was developed to make information widely available in an attempt to thwart Internet and network hackers.
- Honeynet
- Honeypot
- Honeywall
- Honeyweb
A: Honeynet

Q: Machines used on a DDoS are known as ____ simply because they have unwittingly become part of the attack.
- ISPs
- soldiers
- zombies
- pawns
A: zombies

Q: ____ is the text version of Ethereal, a packet sniffer tool.
- Tcpdump
- Ethertext
- Etherape
- Tethereal
A: Tethereal

Q: ____ is a good tool for extracting information from large Libpcap files.
- Nmap
- Tcpslice
- Pcap
- TCPcap
A: Tcpslice

Q: A ____ is a computer set up to look like any other machine on your network, but it lures the attacker to it.
- honeywall
- honeypot
- honeynet
- honeyhost
A: honeypot

Q: ____ is the U.S. DoD computer forensics lab’s version of the dd command that comes with Knoppix-STD.
- chntpw
- john
- memfetch
- dcfldd
A: dcfldd

Q: The term ____________________ means how long a piece of information lasts on a system.
A: order of volatility (OOV) / order of volatility / OOV / OOV (order of volatility)

Q: ____________________ logs record traffic in and out of a network.
A: Network

Q: ____________________ is a layered network defense strategy developed by the National Security Agency (NSA).
A: Defense in depth (DiD) / Defense in depth / DiD / DiD (Defense in depth)

Q: The U.K. Honeynet Project has created the ____________________. It contains the honeywall and honeypot on a bootable memory stick.
A: honeystick

Q: What are some of the tools included with the PSTools suite?

Q: Describe some of the Windows tools available at Sysinternals.