CySA+ Test Forensic Analysis 2

Question 1

A forensic analyst is examining a Windows system and needs to determine which processes were running at the time of an incident. Which artifact best preserves this volatile data?

Accepted Answer

Hibernation file (hiberfil.sys)

Answer

Windows Event Log (System)

Answer

Prefetch files in C:\Windows\Prefetch

Answer

Volume Shadow Copies

Question 2

During a memory forensics investigation, an analyst finds a process with no parent process ID and no associated executable on disk. This is MOST likely indicative of:

Accepted Answer

A kernel-mode rootkit hiding the process

Answer

Process hollowing or code injection

Answer

A legitimate Windows system process

Answer

An orphaned process after parent termination

Question 3

Which file system artifact on NTFS records the last 26 characters typed into the Windows Run dialog, even after a user clears the run history?

Accepted Answer

Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Answer

NTFS $LogFile

Answer

LNK files in Recent folder

Answer

Windows.edb search index

Question 4

A forensic examiner must analyze a disk image without altering it. Which command correctly mounts the image as read-only on Linux?

Accepted Answer

mount -o ro,loop disk.img /mnt/evidence

Answer

mount -t ntfs disk.img /mnt/evidence

Answer

losetup -f disk.img && mount /dev/loop0 /mnt/evidence

Answer

dd if=disk.img of=/dev/sdb bs=4M

Question 5

When analyzing network packet captures during an incident, an analyst notices large DNS TXT record responses to an unusual external domain at regular intervals. This MOST likely indicates:

Accepted Answer

DNS tunneling used for data exfiltration or C2

Answer

DNS cache poisoning in progress

Answer

A misconfigured internal DNS resolver

Answer

Normal CDN health-check traffic

Question 6

A forensic analyst is reviewing Windows Security event logs and sees Event ID 4624 with Logon Type 3 from an external IP. What does this indicate?

Accepted Answer

A network logon, such as accessing a shared folder

Answer

A local interactive logon at the console

Answer

A remote desktop (RDP) session

Answer

A service account logon

Question 7

Which hashing algorithm is MOST appropriate for generating forensic integrity checksums of evidence files today, given known weaknesses in older algorithms?

Accepted Answer

SHA-256

Answer

MD5

Answer

SHA-1

Answer

CRC32