In cloud forensics, which factor primarily determines the types of evidence that can be collected by the customer?

The brand of the cloud provider

The shared responsibility model of the cloud service

The speed of the internet connection

The physical location of the cloud data center

A SOC analyst is reviewing network logs and notices that a compromised host is communicating with an IP address on port 445 (SMB) to an external IP. The analyst suspects data exfiltration. Which additional evidence would most strongly support this hypothesis?

The host is transferring large files to the external IP over SMB, as seen in the network traffic.

The host is performing DNS queries to resolve the external IP.

The host is sending small packets to the external IP at regular intervals.

The host is using SMB to access a legitimate file share on the external IP.

During static analysis of a suspicious binary, an analyst extracts readable text strings. What is the primary purpose of examining these strings?

To calculate the hash of the binary

To determine the exact compilation date of the binary

To identify potential indicators of compromise such as URLs or file paths

To verify the digital signature of the binary

What is the typical first step in a malware analysis workflow?

Execute the malware in a sandbox

Submit the malware to an online scanner

Perform static analysis to gather basic information

Disassemble the malware using a debugger

EC-CouncilCertified SOC Analyst

Domain 6Objective 2

Forensic Investigation and Malware Analysis CSA Practice Questions (Page 2)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

55questions here

11free pages

10concepts

Questions 6–10

6foundation · easy
In cloud forensics, which factor primarily determines the types of evidence that can be collected by the customer?
Select an answer first
7application · medium
A SOC analyst is reviewing network logs and notices that a compromised host is communicating with an IP address on port 445 (SMB) to an external IP. The analyst suspects data exfiltration. Which additional evidence would most strongly support this hypothesis?
Select an answer first
8foundation · easy
A malware sample is compressed and encrypted to hide its true code. What is this technique called?
Select an answer first
9foundation · easy
During static analysis of a suspicious binary, an analyst extracts readable text strings. What is the primary purpose of examining these strings?
Select an answer first
10foundation · easy
What is the typical first step in a malware analysis workflow?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.