A SOC analyst is collecting evidence from a compromised server. The analyst has already captured a memory dump and a disk image. What is the next step to ensure the evidence is preserved for later analysis?

Immediately begin analyzing the disk image to identify the malware.

Copy the evidence to a shared network drive for the team to access.

Delete the memory dump because the disk image is sufficient.

Calculate cryptographic hashes of the memory dump and disk image, and store them in a secure location.

During dynamic analysis, a malware sample detects that it is running inside a virtual machine and exits without performing its malicious actions. Which anti-analysis technique is the malware using?

Obfuscation, which makes the code difficult to read.

Anti-VM detection, which checks for virtualization artifacts such as specific hardware IDs or drivers.

Packing, which compresses the malware to hide its code.

Anti-debugging, which detects debugger presence and alters execution.

A forensic analyst is examining a memory dump from a compromised system. Which type of information is most likely to be found ONLY in memory and not on disk?

The master boot record of the hard drive

Decrypted passwords or encryption keys in use

Deleted files that have been overwritten

A malware analyst is performing static analysis on a suspicious executable. The file's entropy is very high, and the section names are non-standard. What does this indicate?

The file is a script that has been compiled into an executable.

The file is corrupted and cannot be analyzed.

The file is likely packed or encrypted, which is a common evasion technique.

The file is a legitimate program compiled with a standard compiler.

A SOC analyst is handling an incident that involves data stored in a cloud service. The legal team requires that evidence be preserved in a forensically sound manner. The cloud provider's shared responsibility model means the customer is responsible for the data. Which action is most appropriate?

Copy the data to a local forensic server using standard tools like `dd`.

Use the cloud provider's native snapshot and logging features to preserve the data and document the collection process.

Ask the cloud provider to physically seize the servers hosting the data.

Delete the data to prevent further exposure, then document the deletion.

EC-CouncilCertified SOC Analyst

Domain 6Objective 2

Forensic Investigation and Malware Analysis CSA Practice Questions (Page 4)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

55questions here

11free pages

10concepts

Questions 16–20

16application · medium
A SOC analyst is collecting evidence from a compromised server. The analyst has already captured a memory dump and a disk image. What is the next step to ensure the evidence is preserved for later analysis?
Select an answer first
17application · medium
During dynamic analysis, a malware sample detects that it is running inside a virtual machine and exits without performing its malicious actions. Which anti-analysis technique is the malware using?
Select an answer first
18foundation · easy
A forensic analyst is examining a memory dump from a compromised system. Which type of information is most likely to be found ONLY in memory and not on disk?
Select an answer first
19application · medium
A malware analyst is performing static analysis on a suspicious executable. The file's entropy is very high, and the section names are non-standard. What does this indicate?
Select an answer first
20expert · hard
A SOC analyst is handling an incident that involves data stored in a cloud service. The legal team requires that evidence be preserved in a forensically sound manner. The cloud provider's shared responsibility model means the customer is responsible for the data. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.