A company uses a SaaS application for HR data. During an incident, the SOC team needs to collect evidence of unauthorized access to employee records. The SaaS provider offers limited logging. Which action is most appropriate to preserve evidence while respecting the shared responsibility model?

Use a network sniffer to capture traffic between the company and the SaaS provider.

Request the provider's audit logs and document the request and receipt in the chain of custody.

Access the SaaS application's database directly to extract the records.

Ask the provider to delete the affected records to prevent further exposure.

A company's web server was compromised. Network logs show outbound HTTPS connections to an IP address that is now offline. The analyst has a pcap file from the time of the incident, but the traffic is encrypted. Which approach is most likely to reveal the command-and-control (C2) communication content?

Run a protocol analyzer to decode the HTTPS payloads using the server's private key.

Replay the captured HTTPS requests against the now-offline IP address.

Use the pcap to identify the C2 server's IP and perform a DNS reverse lookup to find its domain.

Extract the TLS session keys from the server's memory dump and decrypt the pcap traffic.

During a cloud incident in Microsoft 365, a SOC analyst needs to determine if a user's account was compromised and what actions the attacker performed. Which log source is most critical to enable and review?

Network firewall logs from the corporate perimeter.

Azure Active Directory sign-in logs only, which show successful and failed login attempts.

Unified Audit Log (UAL) in Microsoft Purview, which captures user and admin activities across services.

Windows Event Logs from the user's local machine.

A SOC analyst is reviewing network traffic from a compromised host. The analyst sees repeated DNS queries to a domain that resolves to different IP addresses every few minutes. The host also communicates with those IPs on port 443 using TLS. Which finding best supports a hypothesis of malware command-and-control (C2) activity?

The use of fast-flux DNS to hide the C2 server behind a rotating set of IP addresses.

The host is using a proxy to anonymize its traffic, which is a common corporate policy.

The use of TLS encryption to protect legitimate web browsing traffic.

The DNS queries are normal because the domain resolves to multiple IPs for load balancing.

EC-CouncilCertified SOC Analyst

Domain 6Objective 2

Forensic Investigation and Malware Analysis CSA Practice Questions (Page 1)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

55questions here

11free pages

10concepts

Questions 1–5

1expert · hard
A company uses a SaaS application for HR data. During an incident, the SOC team needs to collect evidence of unauthorized access to employee records. The SaaS provider offers limited logging. Which action is most appropriate to preserve evidence while respecting the shared responsibility model?
Select an answer first
2expert · hard
A company's web server was compromised. Network logs show outbound HTTPS connections to an IP address that is now offline. The analyst has a pcap file from the time of the incident, but the traffic is encrypted. Which approach is most likely to reveal the command-and-control (C2) communication content?
Select an answer first
3application · medium
During a cloud incident in Microsoft 365, a SOC analyst needs to determine if a user's account was compromised and what actions the attacker performed. Which log source is most critical to enable and review?
Select an answer first
4application · medium
A SOC analyst is reviewing network traffic from a compromised host. The analyst sees repeated DNS queries to a domain that resolves to different IP addresses every few minutes. The host also communicates with those IPs on port 443 using TLS. Which finding best supports a hypothesis of malware command-and-control (C2) activity?
Select an answer first
5foundation · easy
A malware analyst wants to understand the behavior of a suspicious executable without executing it. Which type of malware analysis is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Forensic Investigation and Malware Analysis CSA Practice Questions (Page 1)

Questions 1–5

A company uses a SaaS application for HR data. During an incident, the SOC team needs to collect evidence of unauthorized access to employee records. The SaaS provider offers limited logging. Which action is most appropriate to preserve evidence while respecting the shared responsibility model?

During a cloud incident in Microsoft 365, a SOC analyst needs to determine if a user's account was compromised and what actions the attacker performed. Which log source is most critical to enable and review?

A malware analyst wants to understand the behavior of a suspicious executable without executing it. Which type of malware analysis is this?

Keep studying — Incident Response, Forensics and Cloud SOC