Incident Response CAS-005 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An analyst is examining a malicious PDF file that was used in a targeted attack. The analyst wants to determine the creator of the PDF and the software used to create it. The PDF's metadata has been stripped. Which technique could still provide clues about the creator?

   • AUse code stylometry on the PDF's binary code.
   • BCompare the PDF's hash to known malicious PDFs.
   • CAnalyze the PDF's internal structure, such as font names and JavaScript code style.
   • DRun the PDF in a sandbox to see what it does.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key output of a root cause analysis?

   • AA backup of all affected systems
   • BA timeline of the incident response team's actions
   • CA list of recommended corrective actions
   • DA list of all malware signatures
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   After a data breach, the incident response team determines that the attacker exploited a vulnerability in a web application. The team has patched the vulnerability and removed the malware. What is the next step to ensure the incident does not recur?

   • AChange all user passwords and enforce multi-factor authentication.
   • BReimage all servers and restore from backups.
   • CIncrease network monitoring and alerting.
   • DConduct a root cause analysis to identify the specific misconfiguration or weakness that allowed the exploit.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following is a typical feature examined in code stylometry?

   • AVariable naming conventions
   • BThe malware's encryption algorithm
   • CThe malware's file signature
   • DThe malware's command-and-control server IP
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of using a malware sandbox during incident response?

   • ATo create a backup of the malware sample for legal evidence purposes.
   • BTo permanently delete malware from infected systems by quarantining the files.
   • CTo automatically patch vulnerabilities exploited by the malware.
   • DTo execute suspicious code in an isolated environment and observe its behavior without risking production systems.
   Reveal Solution Discussion Select an answer first