CCD Log Analysis & Forensics 4

Question 1

A forensic analyst uses the 'strings' command on a suspicious binary and finds base64-encoded PowerShell commands. What technique does this suggest?

Accepted Answer

Obfuscated payload delivery

Answer

Embedding base64-encoded commands within a binary is a common obfuscation technique to hide malicious PowerShell from signature-based detection.

Question 2

When analyzing a Windows memory dump with Volatility, which plugin would you use to detect injected code in process memory?

Accepted Answer

malfind

Answer

The 'malfind' plugin in Volatility identifies memory regions with suspicious characteristics such as executable permissions and no mapped file, indicating code injection.

Question 3

What is the purpose of computing an MD5 or SHA-256 hash of a forensic disk image immediately after acquisition?

Accepted Answer

To verify integrity and detect any subsequent modification of the evidence

Answer

Hashing the image at acquisition creates a cryptographic fingerprint; a matching hash later confirms the image has not been altered, supporting evidence integrity.

Question 4

In Splunk, which search command would you use to count events grouped by a specific field such as 'src_ip'?

Accepted Answer

stats count by src_ip

Answer

The 'stats count by <field>' command aggregates events and counts occurrences grouped by the specified field.

Question 5

An analyst finds a scheduled task on a Windows host that executes a script from a temp directory every 15 minutes. Which forensic artifact should be examined first to determine when the task was created?

Accepted Answer

Windows Task Scheduler XML files under C:\Windows\System32\Tasks

Answer

Scheduled task XML files store creation time, last run time, author, and the action to be executed, making them the primary artifact for task investigation.

(CCD) Certified Cyber Defender Practice Test

(CCD) Certified Cyber Defender Practice Test

CCD Log Analysis & Forensics 4