CSI Cybersecurity & Digital Evidence Handling 3

Question 1

During a corporate data breach investigation, investigators identify exfiltration via DNS tunneling. What characteristic best identifies DNS tunneling activity in log analysis?

Accepted Answer

Abnormally long or high-frequency DNS queries to a single external domain

Answer

DNS tunneling encodes data inside DNS queries, resulting in unusually long subdomains or an abnormally high volume of queries to one domain.

Question 2

Which chain of custody principle ensures that digital evidence collected at a scene can be traced from collection through court presentation?

Accepted Answer

Continuity of evidence documentation

Answer

Continuity of evidence documentation (chain of custody) records every person who handled evidence and all transfers, ensuring traceability.

Question 3

A forensic image of a suspect hard drive differs in hash value from the original drive after acquisition. What does this MOST likely indicate?

Accepted Answer

The evidence may have been altered or the acquisition process was flawed

Answer

A hash mismatch means the image does not exactly match the source, indicating possible evidence tampering or an acquisition error.

Question 4

In cybersecurity investigations, what does the term 'persistence mechanism' refer to?

Accepted Answer

A technique malware uses to survive system reboots and remain active

Answer

Persistence mechanisms (registry run keys, scheduled tasks, services) allow malicious code to re-execute after reboots.

Question 5

Which volatile data source should a CSI investigator capture FIRST on a live Windows system before powering it down?

Accepted Answer

Running processes and active network connections

Answer

Running processes and network connections exist only in RAM and disappear when the system is shut down, making them the highest-priority volatile artifact.

(CSI) Certified Security Investigator Practice Test

(CSI) Certified Security Investigator Practice Test

CSI Cybersecurity & Digital Evidence Handling 3