Incident Response GIME Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   You are responding to a macOS incident where malware has established persistence via a LaunchAgent and is also injecting code into a legitimate process. The system is running and you have admin access. You need to preserve evidence while minimizing disruption to the user's work. Which approach best balances evidence preservation and operational continuity?

   • ACapture memory and process information first, then analyze the LaunchAgent plist
   • BReboot the system to clear the injected code
   • CDisconnect the system from the network and then image the disk
   • DImmediately kill the malicious process and delete the LaunchAgent
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   You are examining a macOS system where malware has modified a system daemon's plist to run a malicious script at boot. The script is still present. Which analysis would best confirm the persistence mechanism and its execution?

   • ASearch for the script's filename in the user's Downloads folder
   • BReview the system's sleep/wake history
   • CCheck the script's file permissions and ownership
   • DCompare the plist to a known-good version and check the script's execution logs
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   You are analyzing a macOS system where malware has modified the /etc/hosts file to redirect traffic. The modification is still present. Which evidence would best confirm the modification and its impact?

   • ACompare the /etc/hosts file to a known-good version and check recent DNS resolution attempts
   • BExamine the user's calendar events
   • CCheck the file's creation date and owner
   • DReview the system's font cache
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During an incident response engagement, you discover a macOS user's LaunchAgent plist that executes a binary from a hidden directory. The binary is currently running and has established outbound network connections. Which approach best preserves the evidence needed to understand the full scope of the compromise?

   • ACapture the running process list, network connections, and memory contents first, then copy the plist and binary for offline analysis.
   • BCopy the plist and binary first, then reboot the system to clear any malicious code from memory before collecting process information.
   • CImmediately terminate the running process and block the network connections, then copy the plist and binary to an external drive.
   • DDisconnect the system from the network, then use a hex editor to examine the binary without executing it, and document the plist contents.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   You are investigating a macOS system where a user reports unusual network activity. You suspect a malicious process is beaconing to a command-and-control server. Which combination of volatile artifacts would best confirm this activity?

   • AFilesystem timestamps and user login history
   • BSystem configuration and installed applications
   • CRunning processes and active network connections
   • DBrowser history and downloaded files
   Reveal Solution Discussion Select an answer first