Incident Response GIME Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   During incident response, you need to collect volatile artifacts from a macOS system to determine its current state. Which of the following is a volatile artifact that should be collected early in the investigation?

   • AThe contents of the /etc/passwd file
   • BThe installed application list
   • CThe system's hostname
   • DA list of running processes
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   When examining an iOS device for artifacts left by malicious code, which of the following is a key location to check for persistence or dropped files?

   • AThe /var/mobile/Library folder
   • BThe /etc/rc.common file
   • CThe /System/Library/Extensions folder
   • DThe /var/db/dhcpclient/leases file
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   You are analyzing a memory dump from a macOS system and find evidence of code injection into a legitimate process. The injected code is not present in the process's binary on disk. What does this indicate?

   • AThe process is using a just-in-time compiler that generates code at runtime.
   • BThe memory dump is corrupted and the code is a false positive.
   • CThe process is running a legitimate plugin that is loaded dynamically.
   • DThe process has been compromised by malware that injected code into its memory space.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   You are responding to an incident on a macOS system where malware has established persistence via a LaunchAgent. The malware is currently running and communicating with a command-and-control server. You need to preserve evidence while minimizing disruption to the user's work. Which approach best balances evidence preservation and operational continuity?

   • ACollect memory and network connections first, then copy the LaunchAgent plist and binary, and finally terminate the process and remove the persistence mechanism.
   • BCopy the LaunchAgent plist and binary, then continue monitoring the system for a week to gather more evidence.
   • CImmediately terminate the malware process and remove the LaunchAgent, then collect memory from the system after reboot.
   • DDisconnect the system from the network, then immediately reboot to clear the malware from memory, and then collect the plist and binary.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In incident response, which of the following is considered a volatile artifact that can help determine if a system is communicating with a command-and-control server?

   • AThe contents of the /etc/hosts file
   • BCurrent network connections
   • CThe system's DNS resolver configuration
   • DThe system's time zone setting
   Reveal Solution Discussion Select an answer first