When performing disk forensics, which of the following is the primary reason for creating a forensic image of a hard drive?

To speed up the analysis process by compressing the data

To create a bootable backup of the operating system

To recover deleted files from the drive

To preserve the original drive as evidence while allowing analysis on a copy

A SOC analyst is responding to a security incident in a Kubernetes cluster running on AWS EKS. The analyst needs to collect evidence of a compromised pod. Which source is most useful for identifying what the attacker did inside the pod?

The worker node's EC2 instance system logs.

AWS CloudTrail logs only, which record API calls to the EKS control plane.

Kubernetes audit logs and container logs (stdout/stderr) from the pod.

The pod's network policy configuration.

A malware sample behaves differently when run in a sandbox compared to a real user environment. The analyst suspects the malware detects virtualized environments. Which dynamic analysis approach is most likely to bypass this evasion and reveal the malware's true behavior?

Run the sample multiple times in the same sandbox and compare results.

Disable the sandbox's network interface to prevent the malware from phoning home.

Increase the sandbox's CPU and memory resources to make it look more powerful.

Use a bare-metal host with network monitoring and system snapshots to execute the sample.

When collecting evidence from a cloud environment, why is it important to consider the data's physical location?

Because cloud providers cannot store data outside their home country

Because data residency and legal jurisdiction may affect evidence admissibility

Because data stored in the cloud is always encrypted

Because physical location determines the performance of the cloud service

An incident responder is collecting evidence from a compromised server. Which action best preserves the chain of custody?

Making a bit-for-bit copy of the evidence

Documenting every person who handles the evidence and when

Encrypting the evidence with a strong algorithm

Storing the evidence in a locked cabinet

EC-CouncilCertified SOC Analyst

Domain 6Objective 2

Forensic Investigation and Malware Analysis CSA Practice Questions (Page 11)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

55questions here

11free pages

10concepts

Questions 51–55

51foundation · easy
When performing disk forensics, which of the following is the primary reason for creating a forensic image of a hard drive?
Select an answer first
52application · medium
A SOC analyst is responding to a security incident in a Kubernetes cluster running on AWS EKS. The analyst needs to collect evidence of a compromised pod. Which source is most useful for identifying what the attacker did inside the pod?
Select an answer first
53expert · hard
A malware sample behaves differently when run in a sandbox compared to a real user environment. The analyst suspects the malware detects virtualized environments. Which dynamic analysis approach is most likely to bypass this evasion and reveal the malware's true behavior?
Select an answer first
54foundation · easy
When collecting evidence from a cloud environment, why is it important to consider the data's physical location?
Select an answer first
55foundation · easy
An incident responder is collecting evidence from a compromised server. Which action best preserves the chain of custody?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.