CREST Incident Response & Forensic Analysis 3

Question 1

In the SANS IR lifecycle, which phase immediately follows 'Identification' and focuses on limiting the spread of a compromise?

Accepted Answer

Containment

Answer

Containment follows Identification and focuses on isolating affected systems to prevent further spread before eradication begins.

Question 2

A forensic analyst is examining a Linux system and wants to identify files modified within the last 24 hours. Which command is most appropriate?

Accepted Answer

find / -mtime -1

Answer

The 'find / -mtime -1' command recursively searches the filesystem for files with a modification time within the last 1 day.

Question 3

Which type of malware analysis technique executes a sample in a controlled environment to observe its behavior without examining the code directly?

Accepted Answer

Dynamic analysis

Answer

Dynamic analysis involves executing malware in a sandboxed environment (like Cuckoo Sandbox) to observe runtime behaviors such as network connections, file modifications, and registry changes.

Question 4

An attacker used 'certutil.exe -decode encoded.txt malware.exe' on a compromised host. What technique does this represent?

Accepted Answer

Living off the Land (LotL) using a trusted Windows binary

Answer

Using certutil.exe (a legitimate Windows certificate utility) to decode and drop malware is a classic Living off the Land technique that abuses trusted binaries to evade detection.

Question 5

During post-incident analysis, investigators find that an attacker exfiltrated data via DNS TXT record queries. What detection strategy would have been most effective?

Accepted Answer

Monitoring for abnormally long or high-frequency DNS queries to external resolvers

Answer

DNS exfiltration typically produces unusually long subdomain labels or high query frequency; monitoring for these anomalies with DNS inspection tools is the most effective detection approach.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Incident Response & Forensic Analysis 3