CySA+ Test Forensic Analysis 3

Question 1

An analyst performing timeline analysis discovers file MAC times (Modified, Accessed, Changed) that predate the file's creation timestamp on the same volume. What does this MOST likely indicate?

Accepted Answer

Timestomping used to disguise malicious file activity

Answer

Filesystem corruption from a bad sector

Answer

A file copied from another volume with original metadata preserved

Answer

Normal behavior when DST clock changes occur

Question 2

During a Linux forensic investigation, which file would an analyst examine to find a history of commands executed as root using sudo, even if the user's bash history was cleared?

Accepted Answer

/var/log/auth.log or /var/log/secure

Answer

/root/.bash_history

Answer

/etc/sudoers

Answer

/var/log/syslog

Question 3

A forensic analyst extracts strings from a malware sample and finds Base64-encoded content that, when decoded, reveals a PowerShell script. This technique is BEST described as:

Accepted Answer

Obfuscation to evade signature-based detection

Answer

Process injection

Answer

Privilege escalation via LOLBins

Answer

Fileless malware persistence

Question 4

Which Volatility framework plugin would BEST help an analyst identify injected code in a running Windows process during memory forensics?

Accepted Answer

malfind

Answer

pslist

Answer

dlllist

Answer

netscan

Question 5

An examiner finds a file with a .jpg extension but the magic bytes at the file header read '50 4B 03 04'. What is the MOST accurate conclusion?

Accepted Answer

The file has been renamed and is actually a ZIP archive

Answer

The file is a corrupted JPEG image

Answer

The file contains steganographic content

Answer

The JPEG header was overwritten during a disk error

Question 6

When performing dead-box forensics on a suspect drive, which action should be taken FIRST before connecting the drive to the forensic workstation?

Accepted Answer

Attach a hardware write blocker to the suspect drive

Answer

Run antivirus software on the workstation

Answer

Create a logical copy of the drive

Answer

Document the drive's serial number and model

Question 7

A CySA+ analyst reviews a memory dump and finds a process named 'svchost.exe' running from C:\Users\Public\svchost.exe. Why is this suspicious?

Accepted Answer

Legitimate svchost.exe always runs from C:\Windows\System32

Answer

svchost.exe should only run on 64-bit systems

Answer

svchost.exe should not appear in memory dumps

Answer

Multiple svchost.exe instances indicate a DDoS attack