A malware analyst has obtained a suspicious executable file. The analyst wants to understand the high-level logic and control flow of the program without executing it. The file is a compiled C++ binary. Which approach is most appropriate for this initial analysis?

Inspect the file with a hex editor to read the raw bytes.

Use a disassembler to view the assembly language instructions.

Use a decompiler to convert the binary back into a high-level language representation.

Run the binary in a debugger and step through each instruction.

A forensic analyst is using AVML to capture memory from a Linux system. The analyst notices that the output file is significantly smaller than the system's total RAM. What is the most likely reason for this size difference?

AVML only captures the kernel's memory, not user-space memory.

The system has a lot of free memory that is not captured.

The analyst made a mistake and only captured a portion of memory.

AVML compresses the memory dump by default.

A forensic team is investigating a data breach. The team has completed the acquisition and preservation of evidence, including memory dumps and disk images. The team is now in the analysis phase. Which action is most consistent with the analysis phase of the digital forensics process?

Documenting the chain of custody for the evidence.

Creating a bit-for-bit copy of the evidence and verifying its hash.

Recovering deleted files from the disk image and correlating them with processes found in the memory dump.

Preparing a final report for legal counsel.

Why is it critical to capture volatile memory quickly and with minimal interaction with the target system?

To prevent the system from crashing during the capture process

To avoid overwriting disk data that could be used as evidence

To preserve the state of volatile data before it changes or is lost

To ensure the memory dump is compressed for easier storage

CertNexusCyberSec First Responder (CFR)

Domain 2Objective 3

Objective 2.3 Perform Digital Forensics. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 4)

Part of the 2.0 Analyze Attacks on Computing Environments domain, which accounts for 20% of the CYBERSEC-FIRST-RESPONDER exam.

41questions here

9free pages

11concepts

20%of the exam

Questions 16–20

16application · medium
A malware analyst has obtained a suspicious executable file. The analyst wants to understand the high-level logic and control flow of the program without executing it. The file is a compiled C++ binary. Which approach is most appropriate for this initial analysis?
Select an answer first
17application · medium
An analyst is analyzing a memory dump from a compromised server. The analyst needs to identify the network connections that were active at the time of the capture. Which Volatility plugin is most appropriate?
Select an answer first
18application · medium
A forensic analyst is using AVML to capture memory from a Linux system. The analyst notices that the output file is significantly smaller than the system's total RAM. What is the most likely reason for this size difference?
Select an answer first
19expert · hard
A forensic team is investigating a data breach. The team has completed the acquisition and preservation of evidence, including memory dumps and disk images. The team is now in the analysis phase. Which action is most consistent with the analysis phase of the digital forensics process?
Select an answer first
20foundation · easy
Why is it critical to capture volatile memory quickly and with minimal interaction with the target system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CYBERSEC-FIRST-RESPONDER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CertNexus. “CYBERSEC-FIRST-RESPONDER” is a trademark of its owner, used for identification only.