CREST Incident Response & Forensic Analysis 2

Question 1

During a live incident, a responder notices that a Windows host has an unusual process injecting into lsass.exe. Which tool is best suited to capture a memory dump of that specific process without rebooting?

Accepted Answer

ProcDump

Answer

ProcDump (Sysinternals) can target a specific process by PID and write a minidump or full dump without requiring a system reboot.

Question 2

Which Windows artifact records the first and last execution time of programs, along with run counts, making it valuable for establishing attacker activity timelines?

Accepted Answer

Prefetch files

Answer

Prefetch files store execution timestamps and run counts for up to 128 (or 1024 on Win8+) programs, making them highly useful for timeline reconstruction.

Question 3

An analyst is reviewing a PCAP and notices beaconing traffic on port 443 to an external IP with jitter of ±10%. What does the jitter most likely indicate?

Accepted Answer

C2 framework using sleep with jitter to evade detection

Answer

Modern C2 frameworks deliberately introduce jitter (random variance in beacon intervals) to avoid pattern-based network detection.

Question 4

When imaging a suspect disk for forensic analysis, which action ensures the integrity of the evidence and allows verification later?

Accepted Answer

Creating a forensic image and generating MD5/SHA-256 hashes of both source and image

Answer

Hashing both the source and the forensic image provides a cryptographic chain of custody that can prove the image is an exact copy.

Question 5

During forensic triage, you find a file with a .jpg extension whose magic bytes are 50 4B 03 04. What does this indicate?

Accepted Answer

The file is a ZIP archive masquerading as a JPEG

Answer

Magic bytes 50 4B 03 04 are the signature for a ZIP archive; the .jpg extension has been changed to hide its true format.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Incident Response & Forensic Analysis 2