StudyXY
RegisterLog in
Information Technology /Cyber-Security: Virtual Machine Forensics

Cyber-Security: Virtual Machine Forensics

Information Technology39 CardsCreated about 2 months ago

This deck covers key concepts and tools related to virtual machine forensics and cyber-security, including hypervisors, network protocols, and defense strategies.

PrintEmbedImportReport

Type 2 hypervisors cannot be used on laptops

False
Tap or swipe ↕ to flip
Swipe ←→Navigate
SSpeak
FFocus
1/39

Key Terms

Term
Definition
Type 2 hypervisors cannot be used on laptops
False
Which tool lists all open network sockets, including those hidden by rootkits?
Memoryze
Network logs record traffic in and out of a network
True
Virtual machines (VMs) help offset hardware costs for companies
True
When intruders break into a network, they rarely leave a trail behind
False
In network forensics, you have to restore the drive to see how malware that attackers have installed on the system works
True
Log in to view all terms

Related Flashcard Decks

Information Technology

Security+ (SY0-701): Additional Knowledge

This flashcard set explores various cybersecurity topics including credential-stuffing attacks, data classification (e.g., private data), and key disaster recovery metrics like RTO. It also highlights protective measures such as hashing for data integrity, automation support challenges, and the use of URL scanning in web filtering to prevent malware infections.

10 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 5.0 Security Program Management and Oversight

This flashcard set covers key concepts in cybersecurity governance frameworks, including centralized governance, data stewardship roles, and compliance laws like SOX. It also addresses environments supporting development and change management, as well as recovery strategies like Recovery Point Objective (RPO) to minimize data loss during system failures.

8 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice: 4.0 Security Operations

This flashcard set explores advanced cybersecurity practices including refining SIEM alert handling, email security protocols (DKIM, DMARC), secure authentication methods, and strategic threat-hunting. It emphasizes how to enhance incident response efficiency and leverage proactive defense techniques like maneuvering to counteract potential threats.

11 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 2.0 Threats, Vulnerabilities, and Mitigations

This deck covers key concepts related to threats, vulnerabilities, and mitigations in cybersecurity, focusing on virtual machine security.

1 cards
View Deck
Information Technology

Security+ (SY0-701): Cert Master Practice; 1.0 General Security Concepts

This flashcard deck covers key concepts from the Security+ (SY0-701) exam, focusing on general security concepts such as technical and operational controls, policy enforcement, and tokenization.

6 cards
View Deck
Information Technology

Security+ (SY0-701): Lesson 16: Summarize Data Protection Part 2

This flashcard deck covers key concepts from the Security+ (SY0-701) Lesson 16, focusing on data protection methods, DLP components, and security awareness training.

25 cards
View Deck

Study Tips

  • Press F to enter focus mode for distraction-free studying
  • Review cards regularly to improve retention
  • Try to recall the answer before flipping the card
  • Share this deck with friends to study together
Cyber-Security: Virtual Machine Forensics
TermDefinition
Type 2 hypervisors cannot be used on laptops
False
Which tool lists all open network sockets, including those hidden by rootkits?
Memoryze
Network logs record traffic in and out of a network
True
Virtual machines (VMs) help offset hardware costs for companies
True
When intruders break into a network, they rarely leave a trail behind
False
In network forensics, you have to restore the drive to see how malware that attackers have installed on the system works
True
Which project was developed to make information widely available in an attempt to thwart Internet and network hackers?
Honeynet
Which product responded to the need for security and performance by producing different CPU designs?
Virtualization Technology (VT)
Which type of forensics can help you determine whether a system is truly under attack or a user has inadvertently installed an untested patch or custom program?
Network Forensics
Which network protocol analyzer can be programmed to examine TCP headers to find the SYN flag?
Tethereal
On which OSI model layers do most packet analyzers operate?
Layers 2 and 3
Which network defense strategy, developed by the National Security Agency (NSA), has three modes of protection?
Defense in Depth
In which type of attack does the attacker keep asking the server to establish a connection?
SYN flood
Before attempting to install a type 2 hypervisor, you need to enable virtualization in the BIOS before attempting to create a VM
True
Which format can be read by most packet analyzer tools?
Pcap
Which tool was designed as an easy-to-use interface for inspecting and analyzing large tcpdump files?
Netdude
Virtual machines are now common for both personal and business use
True
What term is used for the machines used in a DDoS attack?
Zombies
Which tool is useful for extracting information from large Libpcap files?
Tcpslice
What type of software runs virtual machines?
A Hypervisor
What determines how long a piece of information lasts on a system?
Order of volatility
A honeywall is a computer set up to look like any other machine on your network, but it lures the attack to it
False
Type 1 hypervisors are usually the ones you find loaded on a suspect machine
False
Which tool allows network traffic to be viewed graphically
Etherape
Which type of virtual machine software is typically, but not exclusively, loaded on servers or workstations with a lot of RAM and storage?
Type 1
A forensic image of a VM includes all snapshots
False
To find network adapters, you use command in Windows and the command in Linux
ipconfig, ifconfig
A layered network defense strategy puts the most valuable data where?
In the innermost layer
Packet analyzers examine what layers of the OSI model?
Layer 2 and 3
Which of the following file extensions are associated with VMware virtual machines?
.vmx, .log, and .nvram
In VirtualBox, a(n) file contains settings for virtual hard drives
.vbox
Which Registry key contains associations for file extensions?
HKEYCLASSESROOT
The number of VMs that can be supported per host by a type 1 hypervisor is generally determined by the amount of _ and .
RAM, storage
When do zero day attacks occur?
On the day the application or OS is released, before the vendor is aware of the vulnerability
You can expect to find a type 2 hypervisor on what type of device?
Desktop, Smartphone, Tablet
Which of the following is a clue that a virtual machine has been installed on a host system?
Virtual network adapter
Virtual Machine Extensions (VMX) are part of which of the following?
Intel Virtualized Technology
What are the three modes of protection in the DiD strategy?
People, Technology, Operations
Tcpslice can be used to retrieve specific timeframes of packet captures
True