CCT Digital Forensics & Malware Analysis 3

Question 1

What is the purpose of YARA rules in malware analysis?

Accepted Answer

Scanning files and memory for patterns that identify malware families

Answer

YARA rules define string and byte patterns that, when matched in a file or process, identify malware samples belonging to a specific family or campaign.

Question 2

A forensic examiner recovers a deleted file from an NTFS partition. Which condition must be true for full recovery to be possible?

Accepted Answer

The file's data clusters have not been overwritten by new data

Answer

When a file is deleted, NTFS marks its clusters as available but does not erase them; if those clusters haven't been reallocated, the file content remains recoverable.

Question 3

Which anti-forensics technique involves an attacker deliberately changing MAC timestamps on files to mislead investigators?

Accepted Answer

Timestomping

Answer

Timestomping modifies a file's Modified, Accessed, and Created timestamps to obscure the true timeline of attacker activity.

Question 4

During a forensic investigation, an examiner finds a file with a .jpg extension but the magic bytes read '50 4B 03 04'. What does this indicate?

Accepted Answer

The file is actually a ZIP archive with a renamed extension

Answer

Magic bytes 50 4B 03 04 are the signature for ZIP archives (PK header); the .jpg extension is a disguise used to evade file-type filters.

Question 5

What is the primary use of steganography in a cybersecurity attack?

Accepted Answer

Hiding data or commands inside innocent-looking carrier files like images

Answer

Steganography conceals data within ordinary files (images, audio, video) so that exfiltrated data or C2 commands appear as legitimate media traffic.

CCT - Certified Cybersecurity Technician Practice Test

CCT - Certified Cybersecurity Technician Practice Test

CCT Digital Forensics & Malware Analysis 3