M6-110 WIN OS ARTIFACTS & PROCESSES
WinOS Artifacts & Processes Quiz
Test your knowledge on Windows Operating System artifacts and processes with our comprehensive quiz! This quiz features 20 challenging questions designed for those interested in digital forensics and incident response.
- Explore various aspects of Windows OS.
- Learn about NTFS, timestamps, and logging.
- Assess your understanding of process persistence and more!
What word does each letter of the PUFNTALR acronym represent? (write the single word only)
PROCESSES, USERS, FILES, NETWORK, TASKS, ACCOUNTS, LOGS, REGISTRY
PROCESSES, USERS, FILES, NETWORK, TIME, ACCOUNTS, LOGS, REGISTRY
PARTITION, USERS, FILES, NETWORK, TASKS, ACCOUNTS, LOGS, REGISTRY
WinOS employs several files/utilities intended to enhance performance and/or recovery, and these can also assist an investigator in finding evidence of attacker activities, even though the attacker may have tried to destroy such evidence. Which of these was not an example of one of these specifically named utilities?
The cad-cache
Prefetch files
LNK files
Jump lists
Which statement is false regarding a WinOS NTFS MFT record?
The $DATA field of an MFT record can contain an entire file
The four elements of an MFT record are: Record Header, $SI, $FN, and $DATA.
ADSs provide a way to "hide" data within an MFT record.
MACE timestamps are found only in the $SI field
Which statement is true regarding WinOS MACE timestamps?
Times in the Master time catalog record are the most easily modifiable by an attacker.
Tools exist to time-stomp timestamps in the $SI field of an MFT record.
Time-stomper is an attacker tool used to change the system clock time.
Any time changes made to the $FN are automatically made to the $SI as well.
It is noteworthy with regard to WinOS logging, that add-on AV and IPS (i.e., security tools) often log to the WinOS' _______________ log, rather than (or in addition to) their own logs.
Security
Application
Audit
System
When the $SI and $FN timestamps differ significantly for a suspect file or directory, what should the investigator do?
Assign more credibility to those found in the $FN
Assign more credibility to those found in the $SI
Ignore both, and—instead—refer to the timestamps in the Record Header of the MFT record.
Assume both have been "stomped", and average them for a "best estimate" attempt.
Which element of a WinOS log entry is most useful for "cross-referencing" with online research resources?
LID
PID
SID
EID
When the file named Notes.txt is deleted in the newer versions of WinOS,…
The file will be named $Notes.txt in the recycle bin
Both Notes.txt and a hash of Notes.txt will be stored in the recycle bin.
The original file and its metadata will be stored to a single file in the recycle bin
The file will be represented by two files in the recycle bin, the $R and the $I
Which command/utility is most directly associated with WinOS task scheduling?
Evtvwr
At
Cron
Nc
Our course text (IR&CF3e) indicated a "top six" list of log events to look for; which of these is not one of them? (Hint: you likely did not memorize these, so just use your practical judgment)
Track all changes made to the Registry
Track alteration to the audit policy.
Track changes to user permissions.
Track the creation, starting, and stopping times of system services.
What was the $1,000,000 ($106) question presented in this section?
Figuring out which of the PUFNTALR artifacts to investigate next.
How to correlate logged events with what actually occurred during an incident
How to reverse engineer a given process to truly know what it does.
Knowing whether each process running on a system is "legitimate" or not.
What is a very well-known project that provides a resource of known-good and known-bad hash references?
JIMS
AVCentral
NSRL
MitreCVE
Which of these is not one of the four main WinOS process persistence methods mentioned in this section?
Malware masquerading as a WinOS service
Malware being set to run as a scheduled task
Malware changing Registry keys/values (e.g., setting to autorun)
Malware assigns itself a very high base priority value
Malware path is in a startup folder
How many of the 19 rogue process checks enumerated in Carnegie Mellon's First Responder Guide can you remember?
What was the (very useful) information provided by fport?
PID + process name
PID + process name + port using
PID + process name + port using + path (to executable)
PID + process name + port using + path (to executable) + NSRL hash check
Which of these terms is used to express the "lineage" (aka parent-child relationship) between processes?
Process tree
Process hierarchy
Execution linked-list
Execution sequence
Which command would provide a list of open files that are associated with a given process?
Netstat.exe
Handle.exe
Pslist.exe
Listdlls.exe
In which WinOS directory names are you likely to fund JMP lists or LNK files (i.e., where are many of these MRU-type resources located)
Recent
Cache
Shortcuts
System32
Which of these could the IR investigator not learn from a WinOS prefetch file?
That a given program ran (even if that program no longer exists on the system).
When a program ran
How many times a program ran.
The PID assigned to the program
Other files/programs opened/launched by a program
Which of these netstat output details is least likely to arouse your IR responder suspicion when investigating a client workstation
A known (often-used) Trojan port in a listening state
An established TCP connection, when no network applications are running
An established connection on a loopback address (127.*.*.*)
A well-know service port (e.g., port 53) open in listening state
{"name":"M6-110 WIN OS ARTIFACTS & PROCESSES", "url":"https://www.quiz-maker.com/QPREVIEW","txt":"Test your knowledge on Windows Operating System artifacts and processes with our comprehensive quiz! This quiz features 20 challenging questions designed for those interested in digital forensics and incident response.Explore various aspects of Windows OS.Learn about NTFS, timestamps, and logging.Assess your understanding of process persistence and more!","img":"https:/images/course4.png"}
More Quizzes
Seguridad 7
1059
Using Threat Intelligence
520
Incident Handling Part 2
13610
Cybersecurity Quiz - Who you gonna call
11610
Security Plus
191025
Ransomware Protection
10537
Security Malware
105116
M6 110 PRACTICE QUIZ FOR IR FUNDAMENTALS
191021
Cybersecurity Quiz - The art of Exploitation
6317
Information assurance 1
10532
ETHICAL HACKING
1059
Intro Poll
5223