CREST Incident Response & Forensic Analysis 2 — Questions and Answers
Question 1: During a live incident, a responder notices that a Windows host has an unusual process injecting into lsass.exe. Which tool is best suited to capture a memory dump of that specific process without rebooting?
- ProcDump (Correct answer)
- dd
- WinPmem
- Volatility
Correct answer: ProcDump
ProcDump (Sysinternals) can target a specific process by PID and write a minidump or full dump without requiring a system reboot.
Question 2: Which Windows artifact records the first and last execution time of programs, along with run counts, making it valuable for establishing attacker activity timelines?
- Amcache.hve
- Prefetch files (Correct answer)
- ShimCache (AppCompatCache)
- UserAssist registry key
Correct answer: Prefetch files
Prefetch files store execution timestamps and run counts for up to 128 (or 1024 on Win8+) programs, making them highly useful for timeline reconstruction.
Question 3: An analyst is reviewing a PCAP and notices beaconing traffic on port 443 to an external IP with jitter of ±10%. What does the jitter most likely indicate?
- Normal HTTPS certificate renewal
- C2 framework using sleep with jitter to evade detection (Correct answer)
- A misconfigured NTP client
- A DDoS amplification attack
Correct answer: C2 framework using sleep with jitter to evade detection
Modern C2 frameworks deliberately introduce jitter (random variance in beacon intervals) to avoid pattern-based network detection.
Question 4: When imaging a suspect disk for forensic analysis, which action ensures the integrity of the evidence and allows verification later?
- Copying files with robocopy /mir
- Creating a forensic image and generating MD5/SHA-256 hashes of both source and image (Correct answer)
- Compressing the disk with 7-Zip before analysis
- Mounting the disk read-write to preserve file access times
Correct answer: Creating a forensic image and generating MD5/SHA-256 hashes of both source and image
Hashing both the source and the forensic image provides a cryptographic chain of custody that can prove the image is an exact copy.
Question 5: During forensic triage, you find a file with a .jpg extension whose magic bytes are 50 4B 03 04. What does this indicate?
- The file is a valid JPEG image
- The file is a ZIP archive masquerading as a JPEG (Correct answer)
- The file is a PDF document
- The file is corrupted and unreadable
Correct answer: The file is a ZIP archive masquerading as a JPEG
Magic bytes 50 4B 03 04 are the signature for a ZIP archive; the .jpg extension has been changed to hide its true format.
Question 6: Which log source on a Windows system specifically records successful and failed authentication events along with the source IP address?
- System event log
- Security event log (Correct answer)
- Application event log
- PowerShell operational log
Correct answer: Security event log
The Windows Security event log records logon events (Event IDs 4624, 4625) including source IP, logon type, and account name.
Question 7: An incident responder runs 'netstat -anob' on a compromised Windows host. What does the '-b' flag specifically reveal?
- The bytes sent and received per connection
- The executable and DLLs responsible for each network connection (Correct answer)
- The number of broadcast packets
- The BGP routing table bindings
Correct answer: The executable and DLLs responsible for each network connection
The -b flag in netstat displays the executable and associated DLLs that created each network connection, helping attribute suspicious connections to specific processes.
CREST Incident Response & Forensic Analysis 2
During a live incident, a responder notices that a Windows host has an unusual process injecting into lsass.exe.
Which tool is best suited to capture a memory dump of that specific process without rebooting?