What is a Cyber Attack or Incident?

What is the primary intention of a cyber-attack?

What is the term used to describe the core principles of information security?

Which type of cybercrime targets individuals?

What is an example of a computer security incident?

What should be done with suspicious events?

What is the main target of Organization Cybercrimes?

What is the most common type of cybercrime attack?

What is the term for unauthorized access to private computers or networks?

What is the goal of cyberstalking?

What is software piracy an example of?

What is the primary use of the 'Dark Web'?

What is the purpose of digital forensics?

What is cyber extortion?

What is the term for the violation of intellectual-property rights?

What is the purpose of online recruitment fraud?

What is the main aspect of digital evidence in digital forensics?

What is the main goal of incident response?

What is DFIR in the context of cybersecurity?

What type of data do analysts typically collect during an investigation?

Why is it important to encrypt incident response data?

What is the purpose of a write blocker in incident response?

What is disk imaging in the context of incident response?

What is the purpose of a forensic examination suite in incident response?

What is the main benefit of using virtual environments in incident response?

What is the purpose of a boot disk in incident response?

What is the goal of log analysis in incident response?

What type of data is stored in a raw image file format?

What is the purpose of AccessData FTK Imager?

What are the two leading hash functions used by FTK Imager?

What is the importance of RAM dump in digital forensics investigation?

What is the characteristic of RAM in digital forensics?

What is the purpose of a Digital Forensics Lab (DFL)?

What are the two domains of computer forensics labs?

What is the benefit of analyzing RAM dumps in digital forensics?

What is the significance of RAM in uncovering hidden or encrypted data?

What is the difference between active-system analysis and static media examination?

What is the primary purpose of gathering facts and additional information about an incident?

Why is it important to know the time zone of an incident?

What is the purpose of an Incident Summary Checklist?

What is included in the Incident Detection Checklist?

What is the purpose of preserving a copy of the malware?

What are the criteria for digital evidence to be classified as genuine and trustworthy?

What is the first step of analyzing digital evidence?

What is the purpose of examining the condition of the computer when it was seized?

What is included in the Network Details Checklist?

What is the purpose of inventorying the hardware on the suspect's computer?

What is the first step in handling digital evidence?

What is the purpose of anti-static shielding bags in digital forensics?

What is the term used to describe hiding sensitive information within an ordinary file or message?

What is one of the methods used to detect steganography?

What type of data do DF examiners need to extract from a computer?

What is the purpose of Windows Event Logs in forensic analysis?

What is one of the channels in Windows Event Logs?

Why do investigators create a digital 'image' of the victim's hard drive?

What type of events are captured in the Security log?

What is one of the methods hackers use to conceal their activities?

What is the purpose of configuring adequate logging on Windows systems?

What is the format in which event logs are stored?

What is the purpose of cryptographic hash values in digital forensics?

What is the name of the forensic tool that helps investigators quickly search, identify, and prioritize potential evidence?

What is the main feature of EnCase that allows for customizable report templates?

What type of data can be extracted from mobile devices using mobile digital forensics software?

What is the primary goal of DF examiners when conducting mobile forensics?

What is the purpose of the Setup log?

What is the most common method of data extraction that allows access to live and deleted data, operating system files, and areas of the device that are not normally accessible to the user?

What is the name of the folder where event logs are stored?

What is the main benefit of using a SIEM or log aggregator?

What type of extraction retrieves the device's file system and interprets the data during the processing stage?

What is the limitation of logical extraction?

What is the method of data extraction that involves accessing the device and recording data displayed on the screen with photographs or video, or by transcribing its data?

What is the method of data extraction that requires the stripping down of the device to its logical board and soldering a certain cable to a certain connection on the board?

What is the limitation of chip-off method?

What type of data can be acquired through logical extraction?

What is the purpose of bootloaders in mobile devices?

What is the advantage of physical extraction over logical extraction?

What is the limitation of forensic software?

A cyber-attack is defined as any attempt to gain unauthorized access to a computer system with the intent to cause damage.

Cyber-attacks aim to only disrupt or destroy computer systems.

A cyber incident refers to any event that compromises the confidentiality, integrity, or availability of data or information.

Individual Cybercrimes target organizations.

Property Cybercrimes target individuals' personal information.

Suspicious events should be ignored until proven otherwise.

FTK Imager is a closed-source software used for creating accurate copies of the original evidence.

Raw image file formats store only a part of the data from the original medium.

FTK Imager can create forensic images of only local hard drives and floppy disks.

Incident response is a disorganized approach to identify an attack, minimize its effects, and remediate the cause.

RAM dump is a process of capturing the contents of a computer's storage device.

DFIR specialists gather and inspect information to determine who attacked them, how they got in, and what tools were used to compromise their systems.

RAM is a non-volatile form of memory that holds data permanently.

Organizations do not need to provide proper training and create documentation for their IR process.

Hash reports are used to compare the integrity of the original evidence with the copied evidence.

Disk images are a bit-for-bit copy of a digital storage device, usually of a hard drive or hard disk.

Digital Forensics Lab (DFL) is used for storing digital evidence.

Memory images contain a wealth of information often available on the hard drive.

Active-system analysis deals with forensic information stored in non-volatile memory.

The most effective way to protect IR data is to encrypt it.

FTK Imager can create forensic images in only one format.

Write blockers allow write commands to be executed on the hard disk during the imaging process.

RAM dump is not essential for digital forensics investigation because it does not hold any valuable information.

IR teams use commercial software only for their investigation.

Disk imaging can be performed using hardware only.

Hash verification is not an important feature of imaging software.

Phishing is a type of cybercrime that targets users and trick them by sending fake messages and emails to get sensitive information.

Ransomware Attack is a type of cybercrime that prevents users from accessing their personal data on the system by decrypting them.

Identity Theft is a type of cybercrime that occurs when a cybercriminal uses their own personal data to commit a fraud or a crime.

Cyber Bullying is also known as offline or internet bullying.

Software Piracy is the legal use or copy of paid software with violation of copyrights or license restrictions.

Digital forensic is a branch of science that focuses on identifying, acquiring, processing, analyzing, and reporting on data stored electronically.

Cyber Extortion is the demand for money by cybercriminals to give back some unimportant data they've stolen.

Online Recruitment Fraud is a type of cybercrime that releases fake job opportunities for the purpose of obtaining a financial benefit from applicants or even making use of their personal data.

Internet Fraud is a type of cybercrime that makes use of the telephone, and it can be considered a general term that groups all the crimes that happen over the telephone.

Digital evidence is a component of criminal activities and digital forensics that is not crucial for law enforcement investigations.

An IP address is more helpful if you know the time zone it belongs to.

It is not necessary to gather facts and additional information about the incident.

The Incident Detection Checklist includes individual system details.

A copy of the malware should not be preserved during the investigation.

The Incident Summary Checklist includes the type of affected resources.

Network monitoring is not necessary during the investigation.

The primary function of the system is not important during the investigation.

The time zone of the incident is not important during the investigation.

The Malware Details Checklist includes the list of systems where the malware was found.

The Incident Summary Checklist includes the contact information of the person who detected the incident.

Digital evidence should be stored in an unsecured location to allow for easy access.

Steganography is a technique used to detect hidden information in files.

Windows Event Logs are structured in three channels.

DF examiners need to extract only emails and office documents from a computer.

Anti-static shielding bags are used to destroy electronic evidence.

Investigators should leave digital evidence unattended during an investigation.

The primary purpose of digital forensics is to delete data from a computer.

Cryptographic hash values are used to tamper with digital evidence.

Stegdetect is a tool used to create steganography.

Digital evidence should be labeled and sealed with a generic container.

Windows Security Event logs contain information about login attempts, elevated privileges, and more.

Error, audit success and failure logs are not important in terms of forensic investigations.

Logical extraction involves retrieving raw binary data from the media storage of the device.

SIEM or log aggregator is not necessary for effective incident response.

A physical extraction can retrieve deleted data, operating system files, and areas of the device that are not normally accessible to the user.

Event logs are stored in TXT format at System32/winevt/Logs folder.

Deleted files can be recovered through logical extraction.

JTAG and Chip-Off methods can be used to extract data from damaged or locked mobile devices.

EnCase Forensic helps investigators quickly search, identify, and prioritize potential evidence across computers, laptops, and mobile devices.

Manual extraction involves accessing the device and recording data displayed on the screen with photographs or video.

DF examiners do not need to extract all passcodes, passwords, or patterns of the exhibit before conducting the work.

Mobile digital forensics software can extract data from call logs, photos, and browsers history.

File System Dump (FSD) retrieves raw binary data from the media storage of the device.

Almost all extraction methods do not require phones to be unlocked.

Bootloaders are used to bypass system locks and passcodes for many devices.

Windows Event Forwarding is enabled by default on all Windows systems.

Chip-Off method does not damage the device.

Windows Event logs are categorized into four levels: information, warning, error, and critical.

Devices operating on Android version 7.0 onwards are encrypted by default.

Physical extraction can be performed on locked or password-protected devices.

A cyber-attack aims to only disable or disrupt computer systems.

Suspicious events should be viewed as potential incidents until proven otherwise.

Property Cybercrimes target individuals.

Cyber-attacks aim to alter, block, delete, manipulate, or steal the data held within computer systems.

Individual Cybercrimes target only organizations.

A cyber incident refers to any event that compromises the confidentiality, integrity, or availability of data or information.

Phishing is a type of social engineering attack that targets systems and trick them by sending fake messages and emails to get sensitive information.

Identity theft occurs when a cybercriminal uses another person's personal data with their permission to commit a fraud or a crime.

Ransomware Attack is a type of cybercrime that makes use of the internet.

Cyber bullying is a type of cybercrime that targets systems.

Software piracy is the legal use or copy of paid software with violation of copyrights or license restrictions.

Digital forensics is a branch of science that focuses on identifying, acquiring, processing, analyzing, and reporting on data stored electronically.

Cyber extortion is the demand for money by cybercriminals to give back some important data they've stolen or stop doing malicious activities.

Online drug trafficking is a type of cybercrime that is not commonly sold and traded online.

Intellectual-property Infringements is the violation or breach of any protected intellectual-property rights such as copyrights and industrial design.

Cybercrime includes cyber-terrorism.

Incident response is a coordinated and structured approach to respond to incidents.

DFIR specialists do not gather and inspect information to determine how to close security gaps.

Memory images contain a wealth of information often available on the hard drive.

Write blockers are devices that allow both read and write commands to be executed on the hard disk.

IR teams use only commercial software for their investigation.

Disk imaging can be performed using only hardware solutions.

The primary goal of incident response is to identify an attack and ignore its effects.

Organizations are not required to provide proper training and create documentation for their IR process.

Encrypting incident response data is not necessary.

IR teams can interface properly with specialized forensics tools using any type of laptop.

Gathering facts and additional information about the incident is not necessary to establish a context.

The IP address of the system is not important during the investigation.

The incident summary checklist includes the date and time the incident was reported and the nature of the incident.

The system's make and model is not important during the investigation.

Network monitoring is not necessary during the investigation.

The primary function of the system is important during the investigation.

The malware details checklist includes the date and time of the detection and the name of the malicious file.

The incident detection checklist includes individual system details and network details.

Digital evidence is not classified as genuine and trustworthy if it meets certain criteria.

The basic steps for computer forensics include inspecting the computer viruses and inventorying the hardware on the suspect's computer.

FTK Imager is an open-source software used for creating disk images.

RAW is not a format used for storing data in a raw file.

RAM dump is not a vital step in preserving volatile data for forensic examination.

FTK Imager cannot create forensic images in E01 format.

Digital Forensics Lab (DFL) is not a tightly controlled area for various levels of computer examination.

Active-system analysis deals with static media examination.

Error-Checks is not a feature found in Expert Witness Format (EWF).

FTK Imager uses only Secure Hash Algorithm (SHA-1) for generating hash reports.

FTK Imager can only create forensic images of local hard drives.

RAM is a non-volatile form of memory that holds data permanently.

Steganography involves encrypting sensitive information within an ordinary file or message.

Investigators should ensure physical security of the digital evidence to prevent it from being lost or compromised.

Digital evidence can be stored in a secure location and accessed later.

Anti-static shielding bags are used to destroy electronic evidence.

The imaging process generates cryptographic hash values to verify the drive's authenticity.

Emails are not typically extracted during digital forensic analysis.

Windows Event Logs are structured in four channels: Application, System, Security, and Setup.

Steganography can be used to hide text, video, images, or audio data.

The primary purpose of the Windows Event Logs is to provide information to administrators and users.

Digital forensic examiners typically begin by creating a physical copy of the victim's hard drive.

Windows Event Logs are structured in five categories/levels.

EnCase Forensic is a tool used to analyze evidence from computers and mobile devices.

Security logs contain login attempts, elevated privileges, and more.

Event logs are stored in CSV format at System32/winevt/Logs folder.

Configuring adequate logging on Windows systems is a critical step towards effective incident response.

Mobile digital forensics software can only extract data from call logs and photos.

DF examiners do not need to extract all passcodes, passwords, or patterns of the exhibit prior to conducting the work.

The primary goal of DF examiners is to delete data from a computer.

Incident response is a disorganized approach to identify an attack, minimize its effects, and remediate the cause.

Windows Event Forwarding is enabled by default on all Windows systems.

Logical extraction can recover deleted files.

Physical extraction retrieves the device's file system and interprets the data during the processing stage.

JTAG extraction is used to extract data from damaged or locked mobile devices.

Manual extraction involves accessing the device and recording data displayed on the screen with photographs or video.

Chip-Off extraction does not damage the device.

File System Dump (FSD) is a type of physical extraction.

Bootloaders are used to bypass system locks and passcodes for many devices.

_logical extraction can be performed on locked or password-protected devices.

A physical extraction can retrieve only live data.

Manual extraction is used when forensic software does not support the model of certain unique mobile devices.

A cyber-attack is defined as any attempt to gain unauthorized access to a computer, computing system or computer ______ with the intent to cause damage.

Cyber-attacks aim to disable, disrupt, destroy, or control computer systems or “device”, or to alter, block, delete, manipulate, or steal the data held within these ______.

A cyber incident refers to any event that compromises the confidentiality, integrity, or availability of data or ______ – core principles of information security.

Common examples of computer security incidents are: - Data theft such as personal ______, email, and documents.

Cyber-attacks aim to disable, disrupt, destroy, or control computer systems or “device”, or to alter, block, delete, manipulate, or steal the data held within these systems, in another word, a cyber incident refers to any event that compromises the ______, integrity, or availability of data or information – core principles of information security.

The main categories of cybercrimes are: 1.Individual Cybercrimes, 2.Organization Cybercrimes, 3.______ Cybercrimes, and 4.

Incident response (IR) is a _____________ approach to go from incident detection to resolution.

DFIR is a term used to refer to the process of collecting, preserving, and analyzing _____________ evidence in cyber security incidents.

Disk images may also be taken from other storage mediums, such as _____________ drives.

The most effective way to keep information about the case safe and protected is to _____________ the data.

A write blocker is a device that enables data to be acquired from a hard disk without modifying the disk's _____________.

The imaging software can include features such as recognition of hidden _____________.

IR teams use virtual environments to make the analysis on the working _____________.

Boot Disks Operating Systems (OS) are used as _____________ tools in IR investigation.

The imaging of a storage medium can be performed using forensic _____________ or hardware.

Incident response is the effort to quickly identify an attack, minimize its effects, contain _____________, and remediate the cause.

Phishing is a type of ______ engineering attack that targets users and trick them by sending fake messages and emails to get sensitive information.

Identity theft occurs when a cybercriminal uses another person's ______ data like credit card numbers or personal pictures without their permission to commit a fraud or a crime.

Ransomware attack is a type of cybercrime that targets users and trick them by sending fake messages and emails to get ______ information.

Cyber bullying is a type of cybercrime that makes use of the internet, and it can be considered a general term that groups all the ______ that happen over the internet.

Cyberstalking can be defined as unwanted ______ content from someone targeting other individuals online with the aim of controlling and intimidating.

Software piracy is the illegal use or copy of ______ software with violation of copyrights or license restrictions.

Social media frauds are the use of social media ______ accounts to perform any kind of harmful activities.

Online drug trafficking is the illegal sale and trade of ______ drugs over the internet.

Electronic money laundering is based on unknown companies or online business that makes ______ payment methods and credit card transactions.

Cyber extremism is the demand for money by cybercriminals to give back some important data they've stolen or stop doing ______ activities.

Image file formats include raw or ______.

Expert Witness Format (EWF) and Advanced Forensic Format (AFF) are ______ formats.

FTK Imager is a ______ software that is used for creating accurate copies of the original evidence.

FTK Imager can create forensic images of local hard drives, floppy disks, Zip disks, CDs, and ______.

HASH REPORTS in FTK Imager generate hash reports for regular files and disk images using ______ hash functions.

RAM dump is the process of capturing the contents of a computer's ______.

RAM is a ______ form of memory that holds data temporarily while a computer is powered on.

Digital Forensics Lab (DFL) is divided into two domains: active-system analysis and ______ media examination.

Static media examinations focus on removable flash drives, external and internal hard disks, and other types of ______ media.

DF examiners usually divide computer forensics labs into two domains: active-system analysis and ______ media examination.

Without ______ it is easy to jump to wrong conclusions.

The date and the time the incident was ______ is important information.

Investigators should ensure the physical security of the digital evidence so it doesn't get ____________ or compromised.

To handle digital evidence, it must be uniquely ____________ and sealed with a proper container.

Security logs contain incidents related to ______ events according to the auditing policy of the Windows operating system.

A list of malwares detected, from the time of your investigation back to the ______.

Anti-static shielding bags are used to store, transport, and protect evidence from ____________ damage.

The critical information stored on the ______ is important to know.

Setup log captures incidents of ______ or upgrading of the Windows operating system.

System log contains ______ generated by the Windows operating system.

Whether the incident is currently ______ is important to know.

The imaging process generates ____________ hash values to verify the drive's authenticity.

Steganography involves hiding sensitive information within an ordinary, non-secret file or ____________.

The primary function of the ______ is important to know.

Event logs are stored in ______ format at System32/winevt/Logs folder.

Hackers can use steganography to hide data files or malware in otherwise ____________ documents.

EnCase Forensic helps investigators quickly search, identify, and prioritize potential ______ across computers, laptops, and mobile devices.

The type of affected ______ is important to know.

New Supported Files in EnCase Forensic include.EXT4, HSFX, Microsoft Office ______ and iOS Physical Images.

Digital Forensic examiners need to extract ____________ from a computer, including emails and office documents.

The incident detection checklist includes individual ______ details.

Windows Event Logs are structured in five ____________ (information, warning, error, critical, and success/failure audit).

The primary function of the ______ log is to capture incidents of installation or upgrading of the Windows operating system.

The first step of analyzing the evidence is to determine what ______ needs to be analyzed.

Windows Event Logs are structured in five ____________ (Application, etc.).

DF examiners try their best to extract ______ for the case.

Digital evidence to be classified as genuine and trustworthy should meet the following criteria: ______ in court.

Almost all extraction methods require phones to be ______.

The primary purpose of digital forensics is to analyze digital evidence and provide useful information to ____________ and users.

The aim of DF examiners is to gather all ______, passwords or patterns of the exhibit, prior to conducting the work.

The File System Dump (FSD) is a hybrid of _____________ Extraction and Logical Extraction.

The ______ method accesses the device and records of the data displayed on the screen with photographs or video.

A physical extraction can retrieve deleted data, operating system files, and areas of the device that are not normally accessible to the ______.

The JTAG and Chip-Off methods can be used to extract the data from mobile devices that are ______ or locked with a password.

The primary goal of the DF Examiner is to retrieve information from the _____________ device.

Logical extraction involves receiving information from the mobile device and allowing the device to present the data for ______.

After the information has been extracted from the device, the SIM card and Micro SD are analyzed ______.

Live data which can be acquired through logical extraction include call and text logs, contact lists, and ______ to active social media.

The ______ method typically allows the DF examiner to access live and deleted data, operating system files and areas of the device that are not normally accessible to the user.

Devices operating on Android version 7.0 onwards are ______ by default.

Match the following cybercrime categories with their descriptions:

Match the following concepts with their definitions in cyber security:

Match the following types of cybercrimes with their targets:

Match the following concepts with their descriptions in cyber security:

Match the following cybercrime categories with their examples:

Match the following concepts with their descriptions in cyber security:

Match the following types of cybercrime with their descriptions:

Match the following incident response concepts with their definitions:

Match the following types of cybercrime with their descriptions:

Match the following types of cybercrime with their descriptions:

Match the following digital forensics data with their descriptions:

Match the following types of digital forensics with their descriptions:

Match the following hardware tools with their uses in IR investigation:

Match the following software tools with their uses in IR investigation:

Match the following cybercrime with its primary usage:

Match the following concepts with their importance in IR investigation:

Match the following types of cybercrime with their descriptions:

Match the following digital forensic terms with their descriptions:

Match the following resources with their uses in IR investigation:

Match the following types of cybercrime with their descriptions:

Match the following concepts with their descriptions in IR investigation:

Match the following types of cybercrime with their descriptions:

Match the following data with their uses in IR investigation:

Match the following types of cybercrime with their descriptions:

Match the following concepts with their importance in DFIR investigation:

Match the following concepts with their uses in incident response:

Match the following incident response checks with their corresponding descriptions:

Match the following with their primary purposes in incident response:

Match the following types of incident response checks with the information they collect:

Match the following factors with their roles in incident response:

Match the following with their roles in computer forensics:

Match the following with their characteristics in digital forensics:

Match the following with their roles in digital forensics:

Match the following with their purposes in incident response:

Match the following with their roles in incident response:

Match the following with their importance in incident response:

Match the following disk imaging formats with their features:

Match the following FTK Imager features with their descriptions:

Match the following RAM dump features with their descriptions:

Match the following computer forensics lab domains with their descriptions:

Match the following tools with their descriptions:

Match the following disk imaging features with their descriptions:

Match the following digital forensics concepts with their descriptions:

Match the following digital forensics tools with their uses:

Match the following digital forensics features with their descriptions:

Match the following digital forensics concepts with their descriptions:

Match the following Windows event logs with their descriptions:

Match the following steps with the guidelines for handling digital evidence:

Match the following steganography techniques with their descriptions:

Match the following log levels with their descriptions:

Match the following incident response tools with their descriptions:

Match the following forensic tools with their purposes:

Match the following EnCase features with their descriptions:

Match the following data types with their extraction methods:

Match the following Windows Event Logs channels with their descriptions:

Match the following mobile digital forensics software features with their descriptions:

Match the following digital forensic tools with their descriptions:

Match the following digital forensics examiners' goals with their descriptions:

Match the following Windows event logs storage locations with their descriptions:

Match the following digital forensic concepts with their descriptions:

Match the following incident response steps with their descriptions:

Match the following incident response activities with their descriptions:

Match the following EnCase Forensic features with their descriptions:

Match the following cybercrime types with their descriptions:

Match the following log aggregator tools with their descriptions:

Match the following digital forensic techniques with their descriptions:

Match the following mobile device data extraction methods with their descriptions:

Match the following data types with the methods that can extract them:

Match the following limitations with the data extraction methods:

Match the following data extraction methods with their benefits:

Match the following data extraction methods with the devices they are suitable for:

Match the following data extraction methods with the level of technical skill required:

Match the following data extraction methods with the type of data retrieved:

Match the following data extraction methods with the limitations of forensic software:

Match the following data extraction methods with the risks involved:

Match the following data extraction methods with the level of data analysis required: