CySA+ Test Forensic Analysis 2

Question 1

A forensic analyst is examining a Windows system and needs to determine which processes were running at the time of an incident. Which artifact best preserves this volatile data?

Accepted Answer

Hibernation file (hiberfil.sys)

Answer

The hibernation file (hiberfil.sys) captures a snapshot of RAM contents including running processes when the system hibernates.

Question 2

During a memory forensics investigation, an analyst finds a process with no parent process ID and no associated executable on disk. This is MOST likely indicative of:

Accepted Answer

A kernel-mode rootkit hiding the process

Answer

A kernel-mode rootkit can manipulate process structures in memory to hide its presence, including unlinking from process lists and removing disk artifacts.

Question 3

Which file system artifact on NTFS records the last 26 characters typed into the Windows Run dialog, even after a user clears the run history?

Accepted Answer

Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Answer

The RunMRU registry key stores the most recently used commands entered in the Windows Run dialog and persists until explicitly deleted.

Question 4

A forensic examiner must analyze a disk image without altering it. Which command correctly mounts the image as read-only on Linux?

Accepted Answer

mount -o ro,loop disk.img /mnt/evidence

Answer

The `-o ro,loop` flags mount the image as read-only using a loop device, preserving forensic integrity.

Question 5

When analyzing network packet captures during an incident, an analyst notices large DNS TXT record responses to an unusual external domain at regular intervals. This MOST likely indicates:

Accepted Answer

DNS tunneling used for data exfiltration or C2

Answer

DNS tunneling encodes data in DNS TXT queries/responses to bypass firewalls, and regular large TXT responses to unusual domains are a strong indicator.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Forensic Analysis 2