Incident Response GIME Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst suspects a macOS system is compromised because an unknown process is making frequent connections to an external IP. The analyst needs to determine whether the process is malicious and how it persists. Which combination of actions provides the most useful evidence?

   • ARun `sudo dmesg` to view kernel messages, `system_profiler` to list hardware, and `mdls` to read metadata.
   • BRun `pkill` to terminate the suspicious process, `rm` to delete the binary, and `crontab -l` to list cron jobs.
   • CRun `lsof -i` to list network connections, `ps aux` to list processes, and `launchctl list` to identify launch agents and daemons.
   • DRun `netstat -an` to list all ports, `top` to show CPU usage, and `defaults read` to read user defaults.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During an incident on an iOS device, you need to determine if a malicious app is communicating with an external server. The device is jailbroken and you have root access. Which volatile data source would be most useful?

   • AThe device's network connection table and running processes
   • BThe App Store purchase history
   • CThe device's backup history
   • DThe app's sandbox container files
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   You are investigating a macOS system where malware has created a LaunchDaemon and a LaunchAgent. The LaunchDaemon runs as root, and the LaunchAgent runs as the user. You need to remove the malware while preserving evidence for legal proceedings. What is the most appropriate action?

   • ADisable the LaunchDaemon and LaunchAgent by renaming the plists, but leave the binaries in place.
   • BCopy both plists and binaries to a forensically sound external drive, then remove the LaunchDaemon and LaunchAgent.
   • CImmediately delete both plists and the associated binaries, then document the action.
   • DReboot the system and then delete the plists and binaries.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During an investigation, you find a suspicious LaunchDaemon plist in /Library/LaunchDaemons that runs a script. The script downloads a payload from a remote server and executes it. You need to determine the scope of the infection and preserve evidence. Which step should you perform FIRST?

   • ACopy the plist and script to a forensically sound external drive and compute hashes.
   • BImmediately delete the plist and script to stop the infection, then document the incident.
   • CRun the script in a sandbox to observe its behavior, then record the results.
   • DCapture memory and active network connections, then copy the plist and script.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   During an incident, you find a LaunchAgent that runs a binary with a valid Apple Developer ID signature. The binary is making network connections that match known malware behavior. You need to decide whether to treat this as malicious. What is the most important factor in your decision?

   • AThe LaunchAgent is in the user's Library, so it is user-installed and likely benign.
   • BThe binary's code signature is valid, so it is likely legitimate.
   • CThe network behavior matches known malware, so it should be treated as malicious despite the signature.
   • DThe binary is not in the system's trusted list, so it is definitely malicious.
   Reveal Solution Discussion Select an answer first