Incident Response GIME Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A macOS system is exhibiting unusual behavior. You suspect malware but need to confirm. Which set of artifacts would provide the strongest evidence of malicious activity?

   • AA user's Downloads folder containing a DMG file, a recently modified document, and a screensaver setting change.
   • BA large number of browser cookies, a full disk, and a recent system update.
   • CA recently created LaunchAgent plist, an unknown process running from /tmp, and outbound connections to an unfamiliar IP address.
   • DAn empty Trash, a clean system log, and a standard login item.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   You are investigating a macOS system where malware is suspected of using a legitimate system tool, such as `osascript`, to execute malicious commands. The tool is running with the user's privileges. Which artifact would help you determine if the tool was used maliciously?

   • AThe list of installed applications.
   • BThe user's browser history.
   • CThe system's unified log entries for `osascript` execution.
   • DThe system's uptime.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   You are investigating a macOS system where malware has modified a system preference pane to load a malicious bundle. The system is running, and you need to confirm the modification and determine if the bundle has been loaded. Which approach would be most effective?

   • AReview the user's browser history for the bundle's download
   • BCheck the system's font cache for the bundle's name
   • CDelete the preference pane and observe if the system behaves normally
   • DCompare the preference pane's plist to a known-good version and check loaded bundles in running processes
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   You are responding to a macOS incident where malware is suspected of using process injection to hide its activity. You have a memory dump, but the system is still running and the user needs to continue working. Which approach allows you to analyze the memory dump without disrupting the user?

   • AAnalyze the memory dump offline on a separate forensic workstation.
   • BRun memory analysis tools directly on the live system.
   • CTerminate suspicious processes and then analyze the memory dump.
   • DReboot the system and then analyze the memory dump from the previous boot.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   You are analyzing a macOS system and find a suspicious file in /Library/LaunchDaemons. The file is a plist that runs a binary located in /private/tmp. The binary is currently running. What does this indicate?

   • AMalware has established persistence by placing a plist in LaunchDaemons and executing from a temporary directory.
   • BThe system is running a legitimate system daemon that was installed by an administrator.
   • CThe binary is a temporary file left by a software installer and is harmless.
   • DThe system is configured to run a maintenance script that cleans temporary files.
   Reveal Solution Discussion Select an answer first