Objective 2.3 Perform Digital Forensics. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A malware analyst is analyzing a packed binary. The analyst has set a breakpoint at the end of the unpacking stub and is now single-stepping through the code. What is the analyst primarily trying to achieve with this technique?

   • AList the imported functions of the packed binary.
   • BDetermine the hash of the packed binary.
   • CIdentify the original entry point (OEP) of the unpacked malware.
   • DDecrypt the network traffic generated by the malware.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A malware analyst has two suspicious files: one is a compiled C binary and the other is a Python script. The analyst wants to understand the behavior of both. Which statement accurately describes the reverse engineering challenge for each?

   • AThe C binary is easier to analyze because it contains more metadata.
   • BBoth files require the same level of effort to reverse engineer.
   • CThe Python script must be disassembled to assembly language before analysis.
   • DThe Python script is easier to analyze because its source code is directly available.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic investigator is testifying in court about evidence collected from a compromised server. The defense attorney challenges the admissibility of the evidence, claiming the chain of custody was broken. Which piece of documentation is most critical for the investigator to present to refute this claim?

   • AThe original forensic image of the hard drive.
   • BA detailed log showing every person who accessed the evidence, the time of access, and the purpose.
   • CA certificate of authenticity for the forensic tools used.
   • DA report of the analysis findings.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During a digital forensics investigation, an analyst has just completed the acquisition of a suspect's hard drive. According to the five phases of digital forensics, which phase comes immediately after acquisition/preservation?

   • APresentation
   • BPost-process
   • CAnalysis
   • DPre-process
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the role of /dev/mem in memory acquisition on Linux systems?

   • AIt contains the system's swap space
   • BIt lists all memory-mapped files
   • CIt provides access to the physical memory of the system
   • DIt stores a compressed copy of the memory dump
   Reveal Solution Discussion Select an answer first