Forensic Investigation and Malware Analysis CSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A company's cloud environment has a suspected data exfiltration. The SOC team has access to VPC flow logs, DNS logs, and application logs. Which combination of logs is most effective for reconstructing the exfiltration path?

   • AApplication logs only, since they contain the actual data that was exfiltrated.
   • BDNS logs only, since they show all domain resolutions.
   • CVPC flow logs only, since they record every packet.
   • DVPC flow logs to identify the source/destination IPs and ports, and DNS logs to resolve the destination domain.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which tool is commonly used for static analysis of a Windows executable to view its imported functions and strings?

   • APE-bear
   • BVolatility
   • CWireshark
   • DSysmon
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A malware analyst receives a suspicious executable file. The analyst runs the `strings` command and finds a suspicious URL, but the file appears to be packed. What is the most appropriate next step in static analysis?

   • AAttempt to unpack the executable using a tool like UPX or a dedicated unpacker, then re-run strings and examine the code structure.
   • BExecute the file in a sandbox to observe its behavior and network connections.
   • CSubmit the file to VirusTotal to check its detection ratio.
   • DDelete the file immediately because it is confirmed malicious.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During an incident response, a SOC analyst needs to collect a memory dump from a compromised Windows server. The server is running critical production services and cannot be powered off. Which action best preserves the integrity of the evidence while meeting the operational constraint?

   • AUse a trusted forensic tool to capture the memory contents to an external forensic drive, then compute a cryptographic hash of the dump file.
   • BPower off the server immediately to freeze the memory state, then remove the hard drive for imaging.
   • CRun the built-in Task Manager to export the process list to a text file for later analysis.
   • DCopy the pagefile.sys file to a USB drive and hash it, as it contains the same data as RAM.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   During static analysis of a malware sample, the analyst notices that the file has a very high entropy value and contains a section named `.UPX0`. What does this indicate?

   • AThe malware is digitally signed by a legitimate vendor.
   • BThe malware is written in a high-level language like C++ and compiled with optimizations.
   • CThe malware is packed with UPX, and the analyst should unpack it before further analysis.
   • DThe malware uses anti-debugging techniques to prevent analysis.
   Reveal Solution Discussion Select an answer first