SANS Advanced Incident Response, Threat Hunting, and Digital Forensics (FOR508) Practice test

These questions are part of the practice quiz. Start practicing

• Which statement correctly describes the relationship between LOLBin and the LOLBAS project?
• Which items are included in intelligence development?
• What is the primary function of Plaso (log2timeline) in timeline analysis?
• Which artifacts are typically examined in disk-based forensics to understand user activity?
• What does EDR stand for?
• What is the primary goal of an IOC?
• If Sysmon is installed, what types of events provide high-fidelity system activity for investigations?
• What is often cited as the most popular malware name on the planet?
• Dormant Malware is defined as which?
• TTPs stands for:
• What is the most widely used indicator of compromise format?
• Which Windows artifact records changes to files and directories on NTFS volumes to aid timeline analysis?
• Which factor drives the decision to enact immediate eradication/remediation?
• ASEP entries are associated with which Windows feature used for startup configuration persistence?
• Among indicator classifications, which type is most commonly represented by hashes of files?
• Whack-a-mole in incident response describes which scenario?
• Which item is listed as an indicator for detecting compromised endpoints without active malware?
• In threat hunting, what is a 'tactic-based hunt' and provide an example.
• Which of the following would be a Computed Indicator?
• What defines an Indicator of Compromise (IOC)?
• What does CRL stand for?
• In the Identification phase, what triggers it and what does it entail?
• What is the primary purpose of YARA rules in malware analysis?
• Which Volatility plugin helps identify the modules loaded by each process, aiding detection of injected code?
• In Windows, what is the USN Change Journal and what is it used for in forensics?
• What is an Indicator of Compromise (IOC) primarily used to describe?
• What is the purpose of Sysmon in Windows incident response, and what kind of events should you collect?
• Which artifact is commonly used to reconstruct macOS user activity?
• What is the primary purpose of the LOLBAS project?
• Which phase immediately follows Installation in Lockheed Martin's Cyber Kill Chain?
• Which containment/active defense phrase emphasizes not tipping off the attacker?
• Follow-Up activities include which of the following?
• What is Timesketch used for in FOR508 practice?
• What does 'dwell time' refer to in incident response?
• Persistence Mechanism refers to methods used to do what?
• What is the purpose of data integrity verification when creating forensic images?
• Which Volatility 2/3 plugin helps identify injected or hidden code by listing DLLs loaded by processes?
• What does dwell time refer to in threat hunting?
• What is the problem identified with the Six-Step incident response process?
• Describe a typical process for evidence triage during a multi-host incident.
• What hashing algorithms are commonly used to verify forensic image integrity, and what order should you apply them?
• Which scenario commonly leads to revocation of a certificate?
• Flame and Stuxnet are notable examples of what cyber technique?
• MITRE ATT&CK is best described as...
• During incident response triage, how should volatile memory be prioritized and why?
• Which type of data is most commonly analyzed in memory forensics to identify credential access?
• What is the focus of the Recovery phase in incident response?
• According to the material, persistence in APT intrusions is manifested in two ways. Which option best describes these two manifestations?
• Which statement best describes the primary objective of containment/active defense?
• Which category describes systems that have no tools or malware, effectively operating by leveraging existing system functionality?
• Which of the following is not an Atomic Indicator?
• Moonlight Maze demonstrates which principle?
• What is MFT and why is it significant in Windows forensic investigations?
• What are the two types of Indicators of Compromise?
• What is the purpose of data normalization in forensic analysis?
• What is pass-the-hash and to which ATT&CK technique does it map?
• What are essential elements of evidence chain of custody during incident response?
• Which action is a remediation objective?
• In the Six-Step Preparation phase, what is the primary emphasis?
• What is the primary purpose of a write blocker in forensic image acquisition?
• How do you use data source normalization and correlation in forensic analysis?
• Which of the following is one of the three steps of remediation?
• Which option best describes STIX's purpose?
• Which describes a Reactive Organization approach?
• What is a key component to building a hunt team?
• Atomic Indicators are pieces of data that are indicators of adversary activity on their own. Which of the following is an example of an Atomic Indicator?
• IPRIP expands to what in Windows networking?
• Which statement describes the difference between containment and eradication?
• The combination of which two ASEP start values can each independently provide persistence for malicious code?
• How does Timesketch support collaborative analysis?
• What best describes a remediation event?
• Which Windows artifact specifically helps identify recently executed programs and their sequence on a host?
• Which phase involves delivering the payload to the target?
• What is the first step in the Six-Step Incident Response Process?
• Which item is included as a recovery model related to patch management?
• Which technique is used as a deception tactic in containment/active defense?
• On Linux systems, where would you typically find authentication logs that help reconstruct user activity after a breach?
• Explain the difference between imaging a disk with dd and using a dedicated forensic imager with hash verification.
• Which statement best describes the purpose of a CRL in security operations?
• What is Plaso's primary function in timeline analysis with Timesketch?
• What is the effect of proper visibility in incident response?
• Which recovery objective focuses on improving authentication methods?
• The RasAuto service is described as what in the source material?
• In memory forensics, what is strings analysis used for and what are its limitations?
• OpenIOC's origin is best described as?
• What is the primary goal of incident hunting?
• Which of the following are typically considered volatile data in memory forensics?
• Which of the following is listed among recovery models?
• In intelligence development, which activity is included?
• In a typical enterprise, which entity monitors security events, alerts, and incident response 24/7?
• How is attack surface enumeration defined, and what are two example sources?
• What is the role of a timeline in incident response?
• Which Windows event categories are most important for incident investigation?
• How do you validate that a memory capture is forensically sound and not tampered with before analysis?
• Which tools are commonly used for timeline creation and visualization in FOR508 practice?
• Name three common Windows artifacts useful for reconstructing execution and persistence.
• Who typically participates in a remediation event?
• What is the primary objective in the Containment and Intelligence Development phase?
• What is the end goal of a remediation event?
• Behavioral Indicators combine other indicators to form a profile.
• What is breakout time in the context of an intrusion?
• Which of the following is listed as a recovery goal related to the network?
• What is the difference between volatile and non-volatile data in incident response?
• Which Windows service, abbreviated as 'RasAuto' in the material, is described as being abused by a China-based APT when disabled?
• True or False: Both ASEP start values mentioned (Automatic and Boot) can provide persistence for malicious code.
• Moonlight Maze is known as an example of which type of attacker?
• Which of the following is identified as a main threat actor group?
• Which class of Windows artifacts are commonly used as persistence indicators for malware triage?
• What is the significance of MFT entries in forensic analysis, and how can deleted files be recovered when their records have not been overwritten?
• What was OpenIOC originally designed to enable?
• In the incident response lifecycle, which phase includes lessons learned, reporting, and improvements?
• The twelve ATT&CK tactic categories were derived from which portion of the Cyber Kill Chain?
• Which statement is associated with the Malware Paradox?
• Which artifacts on a MacOS system are commonly used by investigators to reconstruct user activity?
• Which of the following is an example of a remediation step?
• What is YARA primarily used for?
• A proper cyber threat intelligence capability will arm the hunting team with:
• What is MALWARE triage and what artifacts would you examine first?
• The RIP Listener Service is associated with which routing protocol?
• In memory forensics with Volatility, what does the pslist plugin reveal?
• Which of the following describes a Hunting Organization?
• What does SOC stand for in security operations?
• Why is memory forensics essential in incident response even when disk data appears intact?
• Which of the following is NOT a phase in Lockheed Martin's Cyber Kill Chain?
• What is the primary purpose of the Follow-Up phase in incident response?
• Which category describes systems that are currently running malware?
• What does dwell time measure in incident response metrics?
• What are the three main phases of the incident response lifecycle according to SANS FOR508?
• How would you approach collecting data from a live host while minimizing further damage or data loss?
• ASEP stands for what in Windows startup concepts?
• What is the primary goal of containment?
• What is the purpose of a chain-of-custody form in a forensic investigation?
• Which of the following best describes the goal of containment during an incident?
• What are the two popular tools for managing indicators of compromise?
• A D-U-N-S number indicates what aspect of a company?
• Which statement about the ASEP start values is true?
• What is STIX?
• Memory-based forensics focuses on which data sources?
• Which statement about IOC goals is true?
• What does the term 'Five-alarm fire' response best describe in incident handling?
• Remediation events typically occur when?
• What is the recommended method to verify the integrity of a forensic image after acquisition?
• In ASEP, which start value indicates Boot start of a device?
• How can DNS log artifacts assist threat hunting? Provide an example.
• Which term is used to describe the tactic of using legitimate Windows binaries for malicious purposes?
• Linux artifacts useful for reconstructing user command history after a breach include which of the following?
• In ASEP, which start value indicates Automatic startup?
• Which description best captures a key property STIX aims to provide?
• Where is the bulk of the incident response time spent?
• What are two unique challenges in cloud forensics compared to on-prem?
• Define 'evidence integrity vs evidence admissibility' in forensic investigations.
• Why is drill-down correlation important in threat hunting, and how is it different from simple rule-based alerts?
• CRITS and MISP are best described as what?
• Who is the author associated with the Malware Paradox quote?
• What are the differences between 'disk-based forensics' and 'memory-based forensics,' including typical artifacts?
• Which artifact is used to track revoked certificates by a CA?
• What is Volatility in memory forensics and why is it important?
• Which phase is described as the phase the victim doesn't see happen but defenders can detect, involving placing the malicious payload into a delivery vehicle?
• In FOR508, what is data carving and when is it used?
• During the Eradication and Remediation phase, which statement best describes its importance and sequencing?
• What is 'shellcode' in malware, and how would you detect it in memory dumps?
• LOLBin stands for what?
• The weaponization phase is described as what?
• Which phase of Lockheed Martin's Cyber Kill Chain involves placing the malicious payload into a delivery vehicle?
• Why are cryptographic hashes important for preserving evidence, and which algorithms are used?
• What are common legal considerations when handling evidence from a cross-border incident?
• How does evidence preservation for legal hold influence incident response timelines?
• Which phase involves exploiting a vulnerability in software, humans, or hardware?
• What is a timeline analysis and why is it essential in incident investigations?
• In live-response best practices, which data category should be collected first to minimize data loss?
• What are 'artifact timelines' and how do they support containment decisions?
• How does Windows Sysmon logging enhance detection capabilities compared to standard Event Logs?
• What is the primary purpose of computing and verifying hashes during forensic image validation?
• Name two memory artifacts that can help detect credential dumping in a RAM capture.
• What is 'anti-forensics' and give two common techniques used to hinder forensic analysis?
• What best describes Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)?
• What does NIST stand for in the context of standards organizations?