Incident Response GIME Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   You are analyzing a macOS system and find a plist in /Library/LaunchDaemons that runs a script. The script is obfuscated and downloads a second-stage payload. What does this indicate about the malware's behavior?

   • AThe malware uses a multi-stage infection process with persistence and network download capability.
   • BThe malware is a keylogger that only captures keystrokes locally.
   • CThe malware is a ransomware that encrypts files immediately.
   • DThe malware is a simple dropper that only runs once and does not persist.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   You are analyzing a macOS system where malware has created a persistence mechanism using a cron job and a LaunchAgent. The system is running, and you need to determine which mechanism is actively executing. Which evidence would best differentiate between the two?

   • AExamine the modification times of the cron job file and the LaunchAgent plist
   • BReview the user's shell history for cron commands
   • CCheck the system log for cron execution and the unified log for LaunchAgent execution
   • DCheck the system's uptime
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   You are investigating a macOS system where a user reports slow performance. You find a process named 'mdworker' running from a non-standard path and a plist in ~/Library/LaunchAgents that loads it. What is the most likely explanation?

   • AThe user has manually created a custom Spotlight indexer for personal files.
   • BMalware has disguised itself as a legitimate process and established persistence via the LaunchAgent.
   • CThe system is infected with a virus that has replaced the Spotlight binary.
   • DThe system is legitimately indexing files with Spotlight, and the plist is a standard system component.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   You are investigating a macOS system and find a LaunchAgent plist that loads a binary from a hidden folder. The binary is not currently running, but you suspect it runs periodically. Which artifact would help you confirm the execution schedule?

   • AThe plist's StartInterval or StartCalendarInterval keys.
   • BThe binary's file creation date.
   • CThe system's unified log for the binary's name.
   • DThe user's shell history.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   During an incident response investigation on a macOS system, you need to identify a persistence mechanism that a piece of malware may have installed. Which of the following artifacts is a persistence mechanism that you should examine?

   • AThe /etc/hosts file
   • BThe ~/Library/Preferences/com.apple.finder.plist file
   • CA LaunchAgent plist in ~/Library/LaunchAgents
   • DThe /var/log/system.log file
   Reveal Solution Discussion Select an answer first