CySA+ Test Forensic Analysis 3 — Questions and Answers
Question 1: An analyst performing timeline analysis discovers file MAC times (Modified, Accessed, Changed) that predate the file's creation timestamp on the same volume. What does this MOST likely indicate?
- Filesystem corruption from a bad sector
- Timestomping used to disguise malicious file activity (Correct answer)
- A file copied from another volume with original metadata preserved
- Normal behavior when DST clock changes occur
Correct answer: Timestomping used to disguise malicious file activity
Timestomping is a technique where attackers modify file timestamps to evade detection; illogical timestamp ordering (e.g., modified before created) is a common indicator.
Question 2: During a Linux forensic investigation, which file would an analyst examine to find a history of commands executed as root using sudo, even if the user's bash history was cleared?
- /var/log/auth.log or /var/log/secure (Correct answer)
- /root/.bash_history
- /etc/sudoers
- /var/log/syslog
Correct answer: /var/log/auth.log or /var/log/secure
The auth.log (Debian/Ubuntu) or secure (RHEL/CentOS) log records all sudo command executions with timestamps and the originating user.
Question 3: A forensic analyst extracts strings from a malware sample and finds Base64-encoded content that, when decoded, reveals a PowerShell script. This technique is BEST described as:
- Process injection
- Obfuscation to evade signature-based detection (Correct answer)
- Privilege escalation via LOLBins
- Fileless malware persistence
Correct answer: Obfuscation to evade signature-based detection
Encoding payloads in Base64 is a common obfuscation technique used to evade static signature detection by antivirus and IDS tools.
Question 4: Which Volatility framework plugin would BEST help an analyst identify injected code in a running Windows process during memory forensics?
- pslist
- malfind (Correct answer)
- dlllist
- netscan
Correct answer: malfind
The `malfind` plugin scans process memory for regions with suspicious characteristics such as executable permissions and MZ headers not associated with mapped DLLs.
Question 5: An examiner finds a file with a .jpg extension but the magic bytes at the file header read '50 4B 03 04'. What is the MOST accurate conclusion?
- The file is a corrupted JPEG image
- The file has been renamed and is actually a ZIP archive (Correct answer)
- The file contains steganographic content
- The JPEG header was overwritten during a disk error
Correct answer: The file has been renamed and is actually a ZIP archive
The magic bytes 50 4B 03 04 (PK\x03\x04) are the signature for ZIP archives; the .jpg extension is misleading and the file is a renamed ZIP.
Question 6: When performing dead-box forensics on a suspect drive, which action should be taken FIRST before connecting the drive to the forensic workstation?
- Run antivirus software on the workstation
- Attach a hardware write blocker to the suspect drive (Correct answer)
- Create a logical copy of the drive
- Document the drive's serial number and model
Correct answer: Attach a hardware write blocker to the suspect drive
A hardware write blocker must be attached first to prevent any writes to the suspect drive, preserving forensic integrity before any other action.
Question 7: A CySA+ analyst reviews a memory dump and finds a process named 'svchost.exe' running from C:\Users\Public\svchost.exe. Why is this suspicious?
- svchost.exe should only run on 64-bit systems
- Legitimate svchost.exe always runs from C:\Windows\System32 (Correct answer)
- svchost.exe should not appear in memory dumps
- Multiple svchost.exe instances indicate a DDoS attack
Correct answer: Legitimate svchost.exe always runs from C:\Windows\System32
Legitimate svchost.exe processes always originate from C:\Windows\System32; a process using the same name from a different path is a masquerading technique.
CySA+ Test Forensic Analysis 3
An analyst performing timeline analysis discovers file MAC times (Modified, Accessed, Changed) that predate the file's creation timestamp on the same volume.
What does this MOST likely indicate?