CCE CCE Incident Response & Malware Analysis 1 — Questions and Answers
Question 1: According to NIST SP 800-61, what are the four phases of the incident response lifecycle?
- Identify, Protect, Detect, Respond
- Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
- Triage, Investigation, Remediation, Closure
- Planning, Execution, Review, Reporting
Correct answer: Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity
NIST SP 800-61 defines the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity.
Question 2: During malware analysis, what is the difference between static and dynamic analysis?
- Static analysis runs the malware; dynamic analysis reads the binary without executing it
- Static analysis examines the malware without executing it; dynamic analysis runs the malware in a controlled environment (Correct answer)
- Static analysis uses network traffic; dynamic analysis uses memory dumps
- Static analysis is faster than dynamic analysis in all cases
Correct answer: Static analysis examines the malware without executing it; dynamic analysis runs the malware in a controlled environment
Static analysis inspects malware code, strings, and structure without execution, while dynamic analysis runs the malware in a sandbox to observe its behavior.
Question 3: What is a 'sandbox' in the context of malware analysis?
- A secure offline backup system
- An isolated virtual environment used to execute and observe malware behavior safely (Correct answer)
- A network segment used for testing patches
- A forensic write blocker
Correct answer: An isolated virtual environment used to execute and observe malware behavior safely
A sandbox is an isolated environment (typically a VM) where malware can be executed and monitored without risk of infecting production systems.
Question 4: In incident response, what does the term 'containment' refer to?
- Deleting all evidence of the incident
- Limiting the spread and impact of an incident while preserving forensic evidence (Correct answer)
- Restoring systems to their pre-incident state
- Reporting the incident to law enforcement
Correct answer: Limiting the spread and impact of an incident while preserving forensic evidence
Containment involves taking steps to stop the incident from spreading further while carefully preserving evidence for forensic analysis.
Question 5: What tool would a CCE examiner use to examine strings embedded in a malware binary without executing it?
- Volatility
- The 'strings' utility or BinText (Correct answer)
- Wireshark
- Autopsy
Correct answer: The 'strings' utility or BinText
The 'strings' command-line utility or tools like BinText extract printable character sequences from a binary, often revealing URLs, registry keys, and function names.
Question 6: What is 'indicators of compromise' (IOCs) and how are they used in incident response?
- Documented software vulnerabilities used to patch systems
- Observable artifacts (IP addresses, file hashes, registry keys) that indicate a system may be compromised (Correct answer)
- Legal court orders for seizing digital evidence
- Network performance benchmarks
Correct answer: Observable artifacts (IP addresses, file hashes, registry keys) that indicate a system may be compromised
IOCs are forensic artifacts such as malicious IP addresses, file hashes, registry entries, or domain names used to identify compromised systems and detect similar attacks.
CCE CCE Incident Response & Malware Analysis 1
According to NIST SP 800-61, what are the four phases of the incident response lifecycle?