Forensic Investigation and Malware Analysis CSA Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A SOC analyst is investigating a data exfiltration incident. The analyst has a PCAP file and needs to determine if sensitive data was sent over the network. The traffic is encrypted with TLS. Which approach is most effective?

   • ACheck the HTTP headers for any embedded data.
   • BLook at the packet sizes and timing to infer data transfer patterns.
   • CUse the session keys from the endpoint (if available) to decrypt the TLS traffic and then inspect the payloads.
   • DAnalyze the DNS queries to identify the destination domain and assume exfiltration occurred.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   A network forensic analyst is reviewing a packet capture from a suspected intrusion. Which type of information is most directly obtained from analyzing network traffic?

   • AThe contents of the suspect's hard drive
   • BThe processes running on the victim machine
   • CThe source and destination IP addresses of the communication
   • DThe hashes of files on the server
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company uses AWS for a critical application. During an incident, the SOC team needs to collect forensic evidence from an EC2 instance. The instance is still running. Which step is most appropriate to preserve evidence while minimizing disruption?

   • ACopy the instance's system log from the AWS console and consider that sufficient evidence.
   • BRDP into the instance and run forensic tools to collect data in place.
   • CCreate a snapshot of the EBS volumes attached to the instance, then detach the volumes and attach them to a forensic instance for analysis.
   • DTerminate the instance immediately to stop any further malicious activity.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A malware analyst has a suspicious file that is a Windows executable. The analyst wants to determine if the file is malicious without executing it. Which technique is most appropriate?

   • APerform static analysis by examining the file's imports, strings, and section headers.
   • BUpload the file to an online scanner like VirusTotal.
   • CCheck the file's digital signature to determine if it is signed by a trusted vendor.
   • DRun the file in a sandbox and monitor its behavior.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   During a cloud incident response, which log source is most likely to provide information about API calls made to cloud resources?

   • AFirewall logs from the customer's on-premises firewall
   • BCloud provider's audit logs (e.g., AWS CloudTrail, Azure Activity Log)
   • CDNS logs from the customer's on-premises server
   • DHypervisor logs
   Reveal Solution Discussion Select an answer first