CySA+ Test Forensic Analysis 3

Question 1

An analyst performing timeline analysis discovers file MAC times (Modified, Accessed, Changed) that predate the file's creation timestamp on the same volume. What does this MOST likely indicate?

Accepted Answer

Timestomping used to disguise malicious file activity

Answer

Timestomping is a technique where attackers modify file timestamps to evade detection; illogical timestamp ordering (e.g., modified before created) is a common indicator.

Question 2

During a Linux forensic investigation, which file would an analyst examine to find a history of commands executed as root using sudo, even if the user's bash history was cleared?

Accepted Answer

/var/log/auth.log or /var/log/secure

Answer

The auth.log (Debian/Ubuntu) or secure (RHEL/CentOS) log records all sudo command executions with timestamps and the originating user.

Question 3

A forensic analyst extracts strings from a malware sample and finds Base64-encoded content that, when decoded, reveals a PowerShell script. This technique is BEST described as:

Accepted Answer

Obfuscation to evade signature-based detection

Answer

Encoding payloads in Base64 is a common obfuscation technique used to evade static signature detection by antivirus and IDS tools.

Question 4

Which Volatility framework plugin would BEST help an analyst identify injected code in a running Windows process during memory forensics?

Accepted Answer

malfind

Answer

The `malfind` plugin scans process memory for regions with suspicious characteristics such as executable permissions and MZ headers not associated with mapped DLLs.

Question 5

An examiner finds a file with a .jpg extension but the magic bytes at the file header read '50 4B 03 04'. What is the MOST accurate conclusion?

Accepted Answer

The file has been renamed and is actually a ZIP archive

Answer

The magic bytes 50 4B 03 04 (PK\x03\x04) are the signature for ZIP archives; the .jpg extension is misleading and the file is a renamed ZIP.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Forensic Analysis 3