Which challenge is unique to cloud forensics compared to traditional on-premises forensics?

Lack of physical access to the underlying hardware

Inability to create cryptographic hashes

A SOC analyst is investigating a suspected memory-resident malware infection on a Windows workstation. The analyst needs to capture evidence that will reveal the malware's process, network connections, and loaded modules. Which action should the analyst take first?

Acquire a memory dump of the system using a tool like WinPmem or DumpIt.

Reboot the system to clear the memory and then run a malware scan.

Check the Windows Event Logs for process creation events.

Run a full disk forensic image of the hard drive.

A SOC analyst is correlating logs from multiple sources to identify a potential data exfiltration. The analyst has firewall logs, proxy logs, and DNS logs. Which correlation would provide the STRONGEST evidence of data exfiltration?

A large outbound HTTP POST request in the proxy log to a domain that was recently resolved in the DNS log

A DNS log showing a query to a rarely visited domain

A proxy log showing a large outbound HTTP POST request to a known domain

A firewall log showing an outbound connection to an external IP

EC-CouncilCertified SOC Analyst

Domain 6Objective 1

Incident Response Process CSA Practice Questions (Page 11)

Part of the Incident Response, Forensics and Cloud SOC domain, which makes up ~23% of our current practice bank.

56questions here

12free pages

9concepts

Questions 51–55

51foundation · easy
In the incident response lifecycle, which phase involves removing the root cause of an incident from affected systems?
Select an answer first
52foundation · easy
Which challenge is unique to cloud forensics compared to traditional on-premises forensics?
Select an answer first
53application · medium
A SOC analyst is investigating a suspected memory-resident malware infection on a Windows workstation. The analyst needs to capture evidence that will reveal the malware's process, network connections, and loaded modules. Which action should the analyst take first?
Select an answer first
54expert · hard
A SOC analyst is correlating logs from multiple sources to identify a potential data exfiltration. The analyst has firewall logs, proxy logs, and DNS logs. Which correlation would provide the STRONGEST evidence of data exfiltration?
Select an answer first
55foundation · easy
Which tool is commonly used to create a forensic image of a disk while preserving the integrity of the original media?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CSA” is a trademark of its owner, used for identification only.

Incident Response Process CSA Practice Questions (Page 11)

Questions 51–55

In the incident response lifecycle, which phase involves removing the root cause of an incident from affected systems?

Which challenge is unique to cloud forensics compared to traditional on-premises forensics?

A SOC analyst is investigating a suspected memory-resident malware infection on a Windows workstation. The analyst needs to capture evidence that will reveal the malware's process, network connections, and loaded modules. Which action should the analyst take first?

A SOC analyst is correlating logs from multiple sources to identify a potential data exfiltration. The analyst has firewall logs, proxy logs, and DNS logs. Which correlation would provide the STRONGEST evidence of data exfiltration?

Which tool is commonly used to create a forensic image of a disk while preserving the integrity of the original media?

Keep studying — Incident Response, Forensics and Cloud SOC