CySA+ Test Forensic Analysis 2 — Questions and Answers
Question 1: A forensic analyst is examining a Windows system and needs to determine which processes were running at the time of an incident. Which artifact best preserves this volatile data?
- Windows Event Log (System)
- Hibernation file (hiberfil.sys) (Correct answer)
- Prefetch files in C:\Windows\Prefetch
- Volume Shadow Copies
Correct answer: Hibernation file (hiberfil.sys)
The hibernation file (hiberfil.sys) captures a snapshot of RAM contents including running processes when the system hibernates.
Question 2: During a memory forensics investigation, an analyst finds a process with no parent process ID and no associated executable on disk. This is MOST likely indicative of:
- A kernel-mode rootkit hiding the process (Correct answer)
- Process hollowing or code injection
- A legitimate Windows system process
- An orphaned process after parent termination
Correct answer: A kernel-mode rootkit hiding the process
A kernel-mode rootkit can manipulate process structures in memory to hide its presence, including unlinking from process lists and removing disk artifacts.
Question 3: Which file system artifact on NTFS records the last 26 characters typed into the Windows Run dialog, even after a user clears the run history?
- NTFS $LogFile
- Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU (Correct answer)
- LNK files in Recent folder
- Windows.edb search index
Correct answer: Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
The RunMRU registry key stores the most recently used commands entered in the Windows Run dialog and persists until explicitly deleted.
Question 4: A forensic examiner must analyze a disk image without altering it. Which command correctly mounts the image as read-only on Linux?
- mount -o ro,loop disk.img /mnt/evidence (Correct answer)
- mount -t ntfs disk.img /mnt/evidence
- losetup -f disk.img && mount /dev/loop0 /mnt/evidence
- dd if=disk.img of=/dev/sdb bs=4M
Correct answer: mount -o ro,loop disk.img /mnt/evidence
The `-o ro,loop` flags mount the image as read-only using a loop device, preserving forensic integrity.
Question 5: When analyzing network packet captures during an incident, an analyst notices large DNS TXT record responses to an unusual external domain at regular intervals. This MOST likely indicates:
- DNS cache poisoning in progress
- DNS tunneling used for data exfiltration or C2 (Correct answer)
- A misconfigured internal DNS resolver
- Normal CDN health-check traffic
Correct answer: DNS tunneling used for data exfiltration or C2
DNS tunneling encodes data in DNS TXT queries/responses to bypass firewalls, and regular large TXT responses to unusual domains are a strong indicator.
Question 6: A forensic analyst is reviewing Windows Security event logs and sees Event ID 4624 with Logon Type 3 from an external IP. What does this indicate?
- A local interactive logon at the console
- A network logon, such as accessing a shared folder (Correct answer)
- A remote desktop (RDP) session
- A service account logon
Correct answer: A network logon, such as accessing a shared folder
Logon Type 3 in Windows Security Event 4624 indicates a network logon, typically used for accessing shared resources over SMB.
Question 7: Which hashing algorithm is MOST appropriate for generating forensic integrity checksums of evidence files today, given known weaknesses in older algorithms?
- MD5
- SHA-1
- SHA-256 (Correct answer)
- CRC32
Correct answer: SHA-256
SHA-256 is the recommended standard for forensic hashing as MD5 and SHA-1 have known collision vulnerabilities that could undermine evidence integrity.
CySA+ Test Forensic Analysis 2
A forensic analyst is examining a Windows system and needs to determine which processes were running at the time of an incident.
Which artifact best preserves this volatile data?