CFC Digital Forensics & Cybercrime 5

Question 1

Which memory forensics artifact can reveal the full command-line arguments used to launch a malicious process, even after the process has terminated?

Accepted Answer

Windows Event ID 4688 (process creation) in Security logs

Answer

Windows Security Event ID 4688 logs process creation events including full command-line arguments when process auditing is enabled, persisting on disk even after the process ends.

Question 2

A social engineering attack where criminals call employees posing as IT support to obtain credentials is best classified as which type of attack?

Accepted Answer

Vishing (voice phishing)

Answer

Vishing (voice phishing) uses telephone calls where attackers impersonate trusted entities such as IT support to manipulate victims into revealing credentials or sensitive information.

Question 3

During forensic analysis of a Linux system, which log file typically contains authentication failures, SSH login attempts, and sudo usage?

Accepted Answer

/var/log/auth.log (or /var/log/secure on RHEL)

Answer

/var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) records PAM authentication events, SSH sessions, and privilege escalation attempts via sudo.

Question 4

What is 'living off the land' (LotL) in the context of cybercrime investigations, and why does it complicate digital forensics?

Accepted Answer

Attackers use legitimate built-in system tools (e.g., PowerShell, WMI) to carry out attacks, reducing malware artifacts

Answer

Living off the land attacks leverage native OS utilities and signed binaries, leaving minimal malware artifacts and making detection harder because the tools themselves are legitimate.

Question 5

A chain of custody document for digital evidence must include which MINIMUM set of information for each transfer?

Accepted Answer

Date/time, transferring party, receiving party, and purpose of transfer

Answer

A valid chain of custody record must capture when the transfer occurred, who released the evidence, who received it, and the reason for the transfer at each handoff.

(CFC) Certified Forensic Consultant Practice Test

(CFC) Certified Forensic Consultant Practice Test

CFC Digital Forensics & Cybercrime 5