CCT Digital Forensics & Malware Analysis 3

Question 1

What is the purpose of YARA rules in malware analysis?

Accepted Answer

Scanning files and memory for patterns that identify malware families

Answer

Automatically removing malware from infected systems

Answer

Monitoring network traffic for C2 communications

Answer

Generating cryptographic hashes of suspicious files

Question 2

A forensic examiner recovers a deleted file from an NTFS partition. Which condition must be true for full recovery to be possible?

Accepted Answer

The file's data clusters have not been overwritten by new data

Answer

The recycle bin has not been emptied

Answer

The file was smaller than 4 KB

Answer

The file was encrypted before deletion

Question 3

Which anti-forensics technique involves an attacker deliberately changing MAC timestamps on files to mislead investigators?

Accepted Answer

Timestomping

Answer

Steganography

Answer

Log wiping

Answer

Slack space hiding

Question 4

During a forensic investigation, an examiner finds a file with a .jpg extension but the magic bytes read '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is actually a ZIP archive with a renamed extension

Answer

The file is a valid JPEG image

Answer

The file is encrypted AES-256

Answer

The file is a Windows PE executable

Question 5

What is the primary use of steganography in a cybersecurity attack?

Accepted Answer

Hiding data or commands inside innocent-looking carrier files like images

Answer

Encrypting malware payload to defeat antivirus scans

Answer

Obfuscating network traffic using tunneling protocols

Answer

Overwriting log files to remove evidence

Question 6

Which log source on a Windows system records successful and failed logon attempts and is critical for intrusion investigations?

Accepted Answer

Security event log

Answer

System event log

Answer

Application event log

Answer

Setup event log

Question 7

A rootkit hides malicious processes by intercepting system calls before they reach the OS kernel. What type of rootkit is this?

Accepted Answer

Kernel-mode rootkit

Answer

Firmware rootkit

Answer

Bootloader rootkit

Answer

User-mode rootkit