Forensic Investigation and Malware Analysis CSA Practice Questions (Page 3)

Questions 11–15

1. 11application · medium · select all that apply

   A malware analyst is tasked with analyzing a new ransomware sample. The analyst wants to understand the malware's behavior without risking infection of the production network. Which of the following are appropriate steps in the malware analysis process? Select all that apply.

   • AExecute the malware on the analyst's main workstation to observe its effects.
   • BDisassemble the binary to analyze its code structure.
   • CPerform static analysis to inspect the file's strings and imports.
   • DUpload the sample to VirusTotal to get a quick detection report.
   • ERun the malware in an isolated sandbox with network monitoring.
   Check answers Discussion Select an answer first
2. 12foundation · easy

   Which malware evasion technique is specifically designed to detect if a debugger is attached to the process?

   • AAnti-debugging
   • BPacking
   • CEncryption
   • DObfuscation
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a key difference between incident response in a traditional on-premises environment and a cloud environment?

   • AIn the cloud, there is no need to preserve evidence because it is all virtual
   • BIn the cloud, the provider may control some of the infrastructure, limiting direct access to certain evidence
   • CIn the cloud, all logs are automatically preserved for years
   • DIn the cloud, incident response is not necessary because the provider handles all security
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A memory dump from an infected workstation contains a suspicious process that is hidden from the normal process list. The analyst suspects rootkit functionality. Which memory forensics technique would most directly reveal the hidden process?

   • ARun a signature-based antivirus scan directly on the memory dump file.
   • BCompare the memory dump's file hash against a known-good baseline of the workstation.
   • CCross-reference the process list from the kernel's active process list with the list from the PsActiveProcessHead linked list.
   • DSearch the raw memory dump for ASCII strings related to the process name.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst receives a suspicious executable file from an employee. The analyst needs to determine the file's purpose without risking infection of the corporate network. Which sequence of actions is most appropriate?

   • AUpload the file to a public online scanner without checking the organization's data-handling policy.
   • BImmediately delete the file and block the employee's email address.
   • CPerform static analysis first, then execute the sample in an isolated sandbox for dynamic analysis.
   • DRun the executable directly on the analyst's workstation to observe its behavior.
   Reveal Solution Discussion Select an answer first