Forensic Investigation and Malware Analysis CSA Practice Questions (Page 10)

Questions 46–50

1. 46expert · hard

   A SOC analyst is analyzing a memory dump from a compromised server. The analyst suspects a rootkit that hides processes. Which technique is most effective for detecting hidden processes in memory?

   • ACross-reference process lists from multiple sources, such as the kernel's process list and the PsActiveProcessHead list.
   • BUse the `pslist` command in Volatility to list all processes.
   • CSearch for process names in the strings output of the memory dump.
   • DCheck the Windows Event Logs for process creation events.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A SOC analyst is collecting evidence from a compromised workstation. The analyst needs to ensure the evidence is admissible in court. Which practice is most important to maintain the chain of custody?

   • ADocument every person who handled the evidence, with timestamps and purpose, and store the evidence in a secure location.
   • BMake multiple copies of the evidence and distribute them to the legal team.
   • CAnalyze the evidence immediately to avoid delays in the investigation.
   • DUse only commercial forensic tools to collect evidence.
   Reveal Solution Discussion Select an answer first
4. 48application · medium

   A malware analyst is given a suspicious document file that is believed to contain a macro-based dropper. The analyst wants to understand the dropper's behavior without executing the document on a production system. Which approach is most appropriate?

   • AOpen the document in Microsoft Word on the analyst's workstation to see what happens.
   • BDelete the document and block all future emails with attachments.
   • CConvert the document to PDF and analyze the PDF for embedded objects.
   • DExtract the macro code using a tool like olevba and analyze it statically, then execute the document in a sandbox if needed.
   Reveal Solution Discussion Select an answer first
5. 49expert · hard

   During an incident, a SOC analyst collects a hard drive image and a memory dump. The analyst needs to preserve the evidence for potential litigation. Which procedure is most critical to maintain the chain of custody?

   • AMake multiple copies of the evidence and distribute them to the legal team.
   • BRecord the hash values of the evidence, document every person who handled it, and store it in a secure location.
   • CAnalyze the evidence immediately to identify the attacker.
   • DStore the evidence on a shared network drive for easy access by the incident response team.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A SOC analyst is collecting evidence from a cloud-based email service for a legal investigation. The organization is subject to data residency regulations. Which action is most important to ensure the evidence is admissible?

   • AStore the collected evidence on the same cloud service to avoid moving data.
   • BDocument the exact location of the data and the legal authority for collection.
   • CUse a third-party tool that automatically collects data from the cloud.
   • DCollect the data as quickly as possible without documenting the process.
   Reveal Solution Discussion Select an answer first