CCT Digital Forensics & Malware Analysis 1

Question 1

Which principle ensures that digital evidence is not altered during a forensic investigation?

Accepted Answer

Write blocking

Answer

Write blockers are hardware or software tools that prevent any write operations to storage media, ensuring evidence integrity during acquisition.

Question 2

What is the correct order of volatility when collecting digital evidence, starting with the most volatile?

Accepted Answer

CPU registers, RAM, network traffic, hard disk

Answer

CPU registers and cache are lost instantly on power-off, followed by RAM, then active network connections, with persistent disk storage being least volatile.

Question 3

A forensic investigator uses the SHA-256 algorithm on a disk image immediately after acquisition and again after analysis. What is the purpose of this action?

Accepted Answer

Verifying the image has not been tampered with

Answer

Hashing the image before and after analysis produces a cryptographic fingerprint; matching hashes prove the image was not altered, maintaining evidence integrity.

Question 4

Which type of malware disguises itself as legitimate software to trick users into installing it?

Accepted Answer

Trojan horse

Answer

A Trojan horse masquerades as a benign or useful application while secretly performing malicious actions once executed by the user.

Question 5

During static malware analysis, which technique is used to identify readable strings embedded in a binary without executing it?

Accepted Answer

Strings extraction

Answer

The 'strings' command extracts human-readable ASCII/Unicode text from a binary, revealing URLs, registry keys, and other indicators without running the malware.

CCT - Certified Cybersecurity Technician Practice Test

CCT - Certified Cybersecurity Technician Practice Test

CCT Digital Forensics & Malware Analysis 1