CySA+ Test Forensic Analysis 4

Question 1

During an investigation, an analyst needs to recover deleted files from an ext4 Linux filesystem. Which tool is MOST appropriate for carving files based on known file signatures?

Accepted Answer

Foremost or Scalpel

Answer

dd

Answer

Autopsy/Sleuth Kit

Answer

strings

Question 2

An analyst is reviewing Windows Prefetch files and notices that an executable was run once but the Prefetch file shows references to files in a temp directory that no longer exist. This MOST likely indicates:

Accepted Answer

A self-deleting malware dropper that cleaned up after execution

Answer

Normal Prefetch optimization behavior

Answer

Filesystem corruption affecting Prefetch data

Answer

The program was run in Safe Mode

Question 3

Which MITRE ATT&CK technique involves an attacker using a legitimate, signed Windows binary to execute malicious code, thereby bypassing application whitelisting?

Accepted Answer

Living off the Land Binaries — LOLBins (T1218)

Answer

Pass the Hash (T1550.002)

Answer

DLL Search Order Hijacking (T1574.001)

Answer

Process Doppelgänging (T1055.013)

Question 4

An analyst examines a suspect workstation and finds an unusual scheduled task that runs a PowerShell command encoded with -EncodedCommand. Which Windows artifact would BEST corroborate this finding?

Accepted Answer

Task Scheduler operational event logs (Event ID 4698, 4702)

Answer

Windows Firewall logs

Answer

Application event log errors

Answer

Windows Defender exclusion list

Question 5

A forensic analyst is examining browser artifacts on a Windows system. Which SQLite database file stores Chrome browsing history?

Accepted Answer

C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\History

Answer

C:\Users\<user>\AppData\Roaming\Google\Chrome\history.db

Answer

C:\ProgramData\Google\Chrome\browsing.sqlite

Answer

C:\Users\<user>\AppData\Local\Google\Chrome\cache.db

Question 6

During an IR engagement, an analyst needs to determine the last time a specific user account logged into a Windows domain workstation. Which is the MOST reliable source?

Accepted Answer

Active Directory's lastLogonTimestamp attribute replicated across all DCs

Answer

The workstation's local Security event log (Event ID 4624)

Answer

Active Directory's lastLogon attribute on the domain controller

Answer

The workstation's System event log

Question 7

An analyst discovers that an attacker used the 'net use' command to map a drive to a remote share. Which Windows artifact would preserve evidence of this lateral movement?

Accepted Answer

Security Event Log Event ID 4648 (logon with explicit credentials) and 4624 Type 3

Answer

Windows Registry key HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation

Answer

Application Compatibility Cache (Shimcache)

Answer

Windows Search index (Windows.edb)