Objective 2.3 Perform Digital Forensics. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst responds to a suspected ransomware infection on a Windows server. The server is still running, and the analyst needs to capture evidence that will be admissible in court. The analyst has a forensic USB drive with pre-approved tools. Which action best preserves the integrity of the volatile evidence?

   • APower off the server immediately to freeze the state of the memory for later analysis.
   • BCopy the contents of the C:\Windows\System32 folder to the forensic drive for later analysis.
   • CLog into the server and use the built-in Task Manager to create a dump file of the suspicious process.
   • DRun a memory capture tool from the forensic USB drive, saving the output to the same drive.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following artifacts can be extracted from a memory dump to understand what a user was doing on a compromised system?

   • ABIOS version
   • BShell history
   • CHard drive serial number
   • DMAC address of the network interface
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A forensic analyst is preparing to capture memory from a Linux system that is suspected of running a rootkit. The analyst wants to acquire the physical memory contents directly. Which file should the analyst target to capture the raw contents of physical memory?

   • A/dev/mem
   • B/proc/kcore
   • C/etc/passwd
   • D/var/log/syslog
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A malware analyst is analyzing a malicious script written in PowerShell. The analyst wants to understand the obfuscation techniques used. Which approach is most appropriate for analyzing this interpreted script?

   • ARun the script in a debugger and step through the machine code.
   • BUse a disassembler to view the assembly code.
   • CUse a decompiler to convert the script to a high-level language.
   • DRead the script directly and deobfuscate it manually or with a script decoder.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does debugging help in malware analysis?

   • AIt encrypts the malware to prevent detection
   • BIt allows the analyst to step through the malware's execution to observe its behavior
   • CIt automatically removes the malware from the system
   • DIt compresses the malware for easier storage
   Reveal Solution Discussion Select an answer first