CCT Digital Forensics & Malware Analysis

Question 1

Which principle ensures that digital evidence is not altered during a forensic investigation?

Accepted Answer

Write blocking

Answer

Non-repudiation

Answer

Chain of custody

Answer

Order of volatility

Question 2

What is the correct order of volatility when collecting digital evidence, starting with the most volatile?

Accepted Answer

CPU registers, RAM, network traffic, hard disk

Answer

Hard disk, RAM, CPU registers, network traffic

Answer

Network traffic, RAM, CPU registers, hard disk

Answer

RAM, hard disk, CPU registers, network traffic

Question 3

A forensic investigator uses the SHA-256 algorithm on a disk image immediately after acquisition and again after analysis. What is the purpose of this action?

Accepted Answer

Verifying the image has not been tampered with

Answer

Encrypting the image for secure storage

Answer

Compressing the image to save space

Answer

Authenticating the investigator's identity

Question 4

Which type of malware disguises itself as legitimate software to trick users into installing it?

Accepted Answer

Trojan horse

Answer

Worm

Answer

Rootkit

Answer

Ransomware

Question 5

During static malware analysis, which technique is used to identify readable strings embedded in a binary without executing it?

Accepted Answer

Strings extraction

Answer

Dynamic instrumentation

Answer

Sandbox detonation

Answer

Behavioral logging

Question 6

What is the primary purpose of a forensic disk image (e.g., an E01 or raw DD image)?

Accepted Answer

To create a bit-for-bit copy of storage media for analysis

Answer

To back up user files for recovery

Answer

To compress evidence for courtroom presentation

Answer

To encrypt data before chain-of-custody transfer

Question 7

Which file system artifact is most useful for determining when files were created, modified, or accessed on an NTFS volume?

Accepted Answer

$MFT (Master File Table)

Answer

Master Boot Record (MBR)

Answer

Volume Boot Record (VBR)

Answer

File Allocation Table (FAT)