Forensic Investigation and Malware Analysis CSA Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A memory dump from a compromised server shows a suspicious process that has injected code into another legitimate process. Which memory forensics technique is most effective for confirming the injection?

   • ARun a network capture to see if the process is communicating with a C2 server.
   • BCheck the process's command line arguments for suspicious flags.
   • CCompare the memory regions of the legitimate process against a known-good baseline to identify anomalous executable memory.
   • DSearch the memory dump for the malware's file signature.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   During static analysis, an analyst uses a disassembler to view the assembly code of a malware sample. The analyst notices a sequence of `int 2dh` instructions. What is the most likely purpose of this sequence?

   • AIt is used to encrypt the malware's payload.
   • BIt is a system call to retrieve the current time.
   • CIt is an anti-debugging technique that triggers a breakpoint exception when a debugger is present.
   • DIt is a common compiler optimization for fast string comparisons.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A SOC analyst is responding to a suspected breach in a Kubernetes cluster running on a cloud provider. Which log source is most likely to reveal the initial access vector?

   • AKubernetes audit logs, which record API server requests including authentication and authorization details.
   • BContainer runtime logs, which show stdout/stderr from containers.
   • CNode system logs, which show OS-level events on worker nodes.
   • DCloud provider's billing logs, which show resource usage.
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   During a cloud incident, the SOC team needs to identify which user or API key performed a specific action in an Azure subscription. Which log source is the most direct and reliable for this purpose?

   • AWindows Event Logs from a VM in the subscription.
   • BAzure Network Watcher flow logs, which show IP traffic but not user identity.
   • CAzure Monitor metrics, which show performance counters but not who performed actions.
   • DAzure Activity Log, which records control-plane operations and the identity that performed them.
   Reveal Solution Discussion Select an answer first
6. 45application · medium

   A SOC analyst is about to start a forensic investigation on a laptop that was used to access a cloud service. The laptop is still running. Which action should the analyst take first to preserve volatile evidence?

   • ACapture the contents of RAM using a trusted forensic tool.
   • BCopy the hard drive using a write blocker.
   • CPower off the laptop immediately to prevent further changes.
   • DDisconnect the laptop from the network to stop remote access.
   Reveal Solution Discussion Select an answer first