Malware Forensics Fundamentals DFE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company has suffered a ransomware attack. The incident response team has contained the infection and collected forensic images. The CEO wants to know whether the ransomware exfiltrated any sensitive data before encrypting the files. Which forensic approach would best answer this question?

   • ACheck the ransomware's ransom note for any mention of data theft
   • BDecrypt the ransomware's encryption algorithm to recover the files
   • CAnalyze network logs and the forensic images for evidence of data transfer to external IP addresses
   • DInterview employees to determine if they noticed any unusual activity
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the first step in a malware forensics investigation process?

   • AContainment of the infection to prevent further spread
   • BAnalysis of the malware's code and behavior
   • CIdentification of the suspected malware and affected systems
   • DReporting the findings to management and law enforcement
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A user reports that after plugging in a USB flash drive found in the parking lot, their workstation began displaying ransom notes and encrypting files. The incident responder needs to identify the initial infection vector. Which action best confirms the vector while preserving evidence?

   • AReview the user's email client for phishing messages with malicious attachments.
   • BCheck the firewall logs for inbound connections from the internet to the workstation.
   • CExamine the USB device's file system for autorun.inf or malicious executables and correlate with the workstation's prefetch and USB history.
   • DRun a full antivirus scan on the workstation to detect the ransomware binary and quarantine it.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic investigator is called to a scene where a suspected malware infection has occurred on a critical server. The server is still running, and the investigator needs to preserve evidence for potential legal action. Which step should the investigator take FIRST to maintain the chain of custody?

   • AImmediately shut down the server to prevent further damage from the malware.
   • BRun a malware scanner on the live server to identify the infection.
   • CDocument the scene, including system time, running processes, and network connections, and then create a forensic image of the server's memory and disk.
   • DDisconnect the server from the network to contain the infection.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A forensic investigator is preparing to analyze a malware sample that was found on a corporate computer. The sample may contain malicious code that could infect the investigator's analysis environment. Which precaution is essential to ensure safety and legal admissibility?

   • ADisable antivirus software on the analysis machine to avoid interference.
   • BAnalyze the sample without documenting the source to protect the identity of the user.
   • CRun the sample directly on the investigator's workstation to observe its behavior in a real environment.
   • DUse a dedicated, isolated virtual machine with no network access and maintain a documented chain of custody for the sample.
   Reveal Solution Discussion Select an answer first