CREST Incident Response & Forensic Analysis 3 — Questions and Answers
Question 1: In the SANS IR lifecycle, which phase immediately follows 'Identification' and focuses on limiting the spread of a compromise?
- Eradication
- Containment (Correct answer)
- Recovery
- Lessons Learned
Correct answer: Containment
Containment follows Identification and focuses on isolating affected systems to prevent further spread before eradication begins.
Question 2: A forensic analyst is examining a Linux system and wants to identify files modified within the last 24 hours. Which command is most appropriate?
- ls -la /
- find / -mtime -1 (Correct answer)
- stat /etc/passwd
- lsof -i
Correct answer: find / -mtime -1
The 'find / -mtime -1' command recursively searches the filesystem for files with a modification time within the last 1 day.
Question 3: Which type of malware analysis technique executes a sample in a controlled environment to observe its behavior without examining the code directly?
- Static analysis
- Code disassembly
- Dynamic analysis (Correct answer)
- Signature-based scanning
Correct answer: Dynamic analysis
Dynamic analysis involves executing malware in a sandboxed environment (like Cuckoo Sandbox) to observe runtime behaviors such as network connections, file modifications, and registry changes.
Question 4: An attacker used 'certutil.exe -decode encoded.txt malware.exe' on a compromised host. What technique does this represent?
- DLL hijacking
- Living off the Land (LotL) using a trusted Windows binary (Correct answer)
- Process hollowing
- Pass-the-hash attack
Correct answer: Living off the Land (LotL) using a trusted Windows binary
Using certutil.exe (a legitimate Windows certificate utility) to decode and drop malware is a classic Living off the Land technique that abuses trusted binaries to evade detection.
Question 5: During post-incident analysis, investigators find that an attacker exfiltrated data via DNS TXT record queries. What detection strategy would have been most effective?
- Blocking all outbound TCP port 53 traffic
- Monitoring for abnormally long or high-frequency DNS queries to external resolvers (Correct answer)
- Disabling the Windows DNS Client service
- Implementing DNSSEC on all internal zones
Correct answer: Monitoring for abnormally long or high-frequency DNS queries to external resolvers
DNS exfiltration typically produces unusually long subdomain labels or high query frequency; monitoring for these anomalies with DNS inspection tools is the most effective detection approach.
Question 6: Which forensic artifact on Windows records a mapping between a shortcut file and its target, including volume serial number and timestamps, even if the target file is later deleted?
- Recycle Bin $I files
- LNK (Shell Link) files (Correct answer)
- Jump Lists
- VSS Shadow Copies
Correct answer: LNK (Shell Link) files
Windows LNK files embed metadata about the target including its MAC timestamps, volume serial number, and original path — even after the target is removed.
Question 7: In the context of IR triage, what is the primary purpose of running 'vol.py -f memory.dmp windows.pstree' during a Volatility analysis session?
- Display all open registry hives
- Show the process hierarchy to identify suspicious parent-child relationships (Correct answer)
- List all loaded kernel drivers
- Extract network packet captures from memory
Correct answer: Show the process hierarchy to identify suspicious parent-child relationships
The pstree plugin reveals parent-child process relationships, helping analysts spot anomalies like cmd.exe spawned by a browser or lsass.exe launching unexpected children.
CREST Incident Response & Forensic Analysis 3
In the SANS IR lifecycle, which phase immediately follows 'Identification' and focuses on limiting the spread of a compromise?