Question 1: What are some process execution artifacts?
Question 2: What are common persistence mechanisms?
Question 3: How would you find evil in a pcap?
Question 4: What logs do you gather for a Windows operating system?
Question 5: What are some ways to obscure source IP?
Question 6: What is a rootkit? How are rootkits detected?