Incident Response GIME Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A macOS system is suspected of being compromised. You have collected a memory dump, but you need to determine if any malicious code is injected into legitimate processes. Which analysis technique would be most effective?

   • AScan the memory dump for known malware signatures and suspicious strings.
   • BCheck the system log for error messages related to the processes.
   • CCompare the memory dump to a known-good baseline of the system's processes.
   • DReboot the system and run a full antivirus scan.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   During an iOS incident, you have a jailbroken device and need to determine if a malicious app is exfiltrating data. The app is currently running. You have limited time before the device must be returned to the user. Which action would provide the most comprehensive evidence within the time constraint?

   • ADisable the app's network access and observe its behavior
   • BOnly record the screen while the app is in use
   • CCapture a memory dump and network connections, then copy the app's sandbox container
   • DOnly copy the app's sandbox container
   Reveal Solution Discussion Select an answer first
3. 38application · medium

   A macOS system is suspected of running a keylogger. You need to identify the process responsible and any files it has created. Which approach would be most effective?

   • AList running processes and correlate with recently modified files in the user's directories
   • BCheck the system's firewall logs
   • CReview the user's email sent items
   • DExamine the system's font cache
   Reveal Solution Discussion Select an answer first