Objective 2.3 Perform Digital Forensics. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In Linux, what does the virtual file /proc/kcore represent?

   • AA list of all kernel modules loaded
   • BThe kernel's core dump file
   • CThe physical memory of the system in ELF core format
   • DA log of kernel messages
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An incident responder is called to a server that is actively being compromised. The attacker is running a process that is encrypting files. The responder has a memory capture tool on a USB drive. What is the most important reason to capture memory immediately, before any other action?

   • ATo ensure the malicious process is not terminated by the system.
   • BTo avoid having to interact with the system more than once.
   • CTo prevent the attacker from deleting the malicious process from the process list.
   • DTo capture the encryption keys and decrypted data that are only present in RAM.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An incident responder has captured a memory dump from a compromised Windows workstation. The responder needs to identify which malicious process was communicating with a known command-and-control server. Which tool and plugin combination is most appropriate for this task?

   • AVolatility with the netscan plugin
   • BThe strings command on the memory dump
   • CWireshark on the memory dump file
   • DVolatility with the pslist plugin
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When analyzing a memory dump, which artifact would help you identify the network connections that were active at the time of capture?

   • AEnvironment variables
   • BSocket status
   • CKernel messages
   • DMemory maps
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   An incident responder needs to capture memory from a live system. Which action best exemplifies minimal interaction to preserve evidence integrity?

   • ARebooting the system to ensure a clean state before capturing memory
   • BCopying the memory dump to the local hard drive for later analysis
   • CUsing a trusted tool to capture memory directly to an external device without executing unnecessary commands on the target
   • DRunning a series of diagnostic commands to gather system information before capturing memory
   Reveal Solution Discussion Select an answer first