Objective 2.3 Perform Digital Forensics. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During a forensic investigation, an analyst has completed the acquisition of a memory dump and a disk image from a compromised Linux server. The analyst has documented the hash values of the evidence and stored the original media in a secure evidence locker. According to the digital forensics process phases, what is the analyst's next primary action?

   • APrepare the final forensic report for presentation to management.
   • BReturn the original media to the system administrator to restore service.
   • CBegin the analysis phase by running Volatility on the memory dump.
   • DCreate a working copy of the evidence and verify the hash of the copy against the original.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An incident responder is on site at a compromised server. The responder has a memory capture tool on a USB drive. The server is running a critical business application, and the business wants to keep it running. The responder must capture memory while minimizing impact on the system. Which approach best balances the need for evidence with the need to minimize disruption?

   • AAsk the system administrator to run the capture tool using their administrative credentials.
   • BCopy the memory capture tool to the server's hard drive and run it from there.
   • CPower off the server to freeze the memory state.
   • DRun the memory capture tool from the USB drive, writing the output to the same USB drive.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary difference between disassembly and decompilation in malware analysis?

   • ADisassembly produces a higher-level language, while decompilation produces assembly language
   • BDisassembly is always automated, while decompilation is always manual
   • CDisassembly converts machine code to assembly language, while decompilation converts machine code to a higher-level language
   • DDisassembly is used for malware analysis, while decompilation is used for vulnerability research
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which tool is widely used for analyzing memory dumps and can extract running processes, network connections, and other artifacts?

   • AVolatility
   • BNmap
   • CWireshark
   • DMetasploit
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the primary purpose of using a forensically sound tool like AVML to capture volatile memory?

   • ATo analyze network traffic in real time
   • BTo preserve the state of running processes and network connections at the time of capture
   • CTo permanently delete malicious code from the system
   • DTo create a backup of the operating system files for recovery purposes
   Reveal Solution Discussion Select an answer first