A SOC analyst is analyzing a memory dump and finds an anomalous process that is not visible in the process list but is present in the memory's kernel structures. The analyst suspects a kernel-level rootkit. Which tool or technique is most effective for further investigation?

Search for the process name in the memory dump's strings.

Use Volatility's `psscan` plugin to enumerate processes by scanning physical memory for process objects.

Use the `pslist` plugin to list processes from the active process list.

Check the Windows Event Logs for process creation events.

During an incident response engagement, a forensic investigator is about to begin collecting evidence from a compromised workstation. Which principle should guide the investigator's actions to ensure the evidence remains admissible in legal proceedings?

Use the most advanced tools available to extract maximum data

Preserve the original evidence and perform analysis on copies

Analyze the original evidence first to avoid missing volatile data

Minimize the number of copies to reduce the risk of data leakage

A SOC analyst is preparing to conduct forensic analysis as part of an incident response. Which legal consideration is most important when handling evidence that may be used in a prosecution?

Using open-source tools to avoid licensing issues

Obtaining proper authorization before collecting evidence

Ensuring the evidence is stored on encrypted media

Deleting irrelevant data to protect privacy

Which network forensic technique is used to reconstruct the sequence of events during an attack?

Correlating timestamps from multiple log sources

EC-CouncilCertified SOC Analyst

Domain 6Objective 2

Forensic Investigation and Malware Analysis CSA Practice Questions (Page 8)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

55questions here

11free pages

10concepts

Questions 36–40

36expert · hard
A SOC analyst is analyzing a memory dump and finds an anomalous process that is not visible in the process list but is present in the memory's kernel structures. The analyst suspects a kernel-level rootkit. Which tool or technique is most effective for further investigation?
Select an answer first
37foundation · easy
During an incident response engagement, a forensic investigator is about to begin collecting evidence from a compromised workstation. Which principle should guide the investigator's actions to ensure the evidence remains admissible in legal proceedings?
Select an answer first
38foundation · easy
A SOC analyst is preparing to conduct forensic analysis as part of an incident response. Which legal consideration is most important when handling evidence that may be used in a prosecution?
Select an answer first
39foundation · easy
Which network forensic technique is used to reconstruct the sequence of events during an attack?
Select an answer first
40foundation · easy
A malware analyst is executing a suspicious sample in a controlled environment to observe its behavior. What is this process called?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.