Chapter 11: Virtual Machines, Network Forensics, and Live Acquisitions MULTIPLE CHOICE 1. ____ can help you determine whether a network is truly under attack or a user has inadvertently installed an untested patch or custom program. a. Broadcast forensics c. Computer forensics b. Network forensics d. Traffic forensics PTS: 1 REF: 442 2. ____ hide the most valuable data at the innermost part of the network. a. Layered network defense strategies c. Protocols b. Firewalls d. NAT PTS: 1 REF: 442 3. ____ Forensics is the systematic tracking of incoming and outgoing traffic on your network. a. Network c. Criminal b. Computer d. Server PTS: 1 REF: 442 4. ____ can be used to create a bootable forensic CD and perform a live acquisition. a. Helix c. Inquisitor b. DTDD d. Neon PTS: 1 REF: 445 5. Helix operates in two modes: Windows Live (GUI or command line) and ____. a. command Windows c. command Linux b. remote GUI d. bootable Linux PTS: 1 REF: 445 6. A common way of examining network traffic is by running the ____ program. a. Netdump c. Coredump b. Slackdump d. Tcpdump PTS: 1 REF: 448 7. ____ is a suite of tools created by Sysinternals. a. EnCase c. R-Tools b. PsTools d. Knoppix PTS: 1 REF: 450 8. ____ is a Sysinternals command that shows all Registry data in real time on a Windows computer. a. PsReg c. RegMon b. RegExplorer d. RegHandle PTS: 1 REF: 450 9. The PSTools ____ kills processes by name or process ID. a. PsExec c. PsKill b. PsList d. PsShutdown PTS: 1 REF: 450 10. ____ is a popular network intrusion detection system that performs packet capture and analysis in real time. a. Ethereal c. Tcpdump b. Snort d. john PTS: 1 REF: 451 11. ____ is the U.S. DoD computer forensics lab’s version of the dd command that comes with Knoppix-STD. a. chntpw c. memfetch b. john d. dcfldd PTS: 1 REF: 451 12. The Knoppix STD tool ____ enables you to reset passwords on a Windows computer, including the administrator password a. chntpw c. oinkmaster b. john d. memfetch PTS: 1 REF: 451 13. ____are devices and/or software placed on a network to monitor traffic. a. Packet sniffers c. Hubs b. Bridges d. Honeypots PTS: 1 REF: 454 14. Most packet sniffers operate on layer 2 or ____ of the OSI model. a. 1 c. 5 b. 3 d. 7 PTS: 1 REF: 454 15. Most packet sniffer tools can read anything captured in ____ format. a. SYN c. PCAP b. DOPI d. AIATP PTS: 1 REF: 455 16. In a(n) ____ attack, the attacker keeps asking your server to establish a connection. a. SYN flood c. brute-force attack b. ACK flood d. PCAP attack PTS: 1 REF: 455 17. ____ is the text version of Ethereal, a packet sniffer tool. a. Tcpdump c. Etherape b. Ethertext d. Tethereal PTS: 1 REF: 455 18. ____ is a good tool for extracting information from large Libpcap files. a. Nmap c. Pcap b. Tcpslice d. TCPcap PTS: 1 REF: 455 19. The ____ Project was developed to make information widely available in an attempt to thwart Internet and network hackers. a. Honeynet c. Honeywall b. Honeypot d. Honeyweb PTS: 1 REF: 458 20. Machines used on a DDoS are known as ____simply because they have unwittingly become part of the attack. a. ISPs c. zombies b. soldiers d. pawns PTS: 1 REF: 458 21. A ____ is a computer set up to look like any other machine on your network, but it lures the attacker to it. a. honeywall c. honeynet b. honeypot d. honeyhost