CySA+ Test Forensic Analysis 4

Question 1

During an investigation, an analyst needs to recover deleted files from an ext4 Linux filesystem. Which tool is MOST appropriate for carving files based on known file signatures?

Accepted Answer

Foremost or Scalpel

Answer

Foremost and Scalpel are file carving tools that scan raw disk images for file header/footer signatures to recover deleted files regardless of filesystem metadata.

Question 2

An analyst is reviewing Windows Prefetch files and notices that an executable was run once but the Prefetch file shows references to files in a temp directory that no longer exist. This MOST likely indicates:

Accepted Answer

A self-deleting malware dropper that cleaned up after execution

Answer

Self-deleting malware often drops a payload, executes it, then removes the temporary files, but Prefetch retains references to all files accessed during execution.

Question 3

Which MITRE ATT&CK technique involves an attacker using a legitimate, signed Windows binary to execute malicious code, thereby bypassing application whitelisting?

Accepted Answer

Living off the Land Binaries — LOLBins (T1218)

Answer

LOLBins (Living off the Land Binaries) are legitimate Windows signed executables that can be abused to execute arbitrary code while appearing legitimate to security controls.

Question 4

An analyst examines a suspect workstation and finds an unusual scheduled task that runs a PowerShell command encoded with -EncodedCommand. Which Windows artifact would BEST corroborate this finding?

Accepted Answer

Task Scheduler operational event logs (Event ID 4698, 4702)

Answer

Windows Task Scheduler logs Event ID 4698 (task created) and 4702 (task updated) in the Security log, providing corroborating evidence of scheduled task manipulation.

Question 5

A forensic analyst is examining browser artifacts on a Windows system. Which SQLite database file stores Chrome browsing history?

Accepted Answer

C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\History

Answer

Chrome stores browsing history in a SQLite database named 'History' located in the user's Chrome Default profile directory.

CySA+ Practice Test Practice Test

CySA+ Practice Test Practice Test

CySA+ Test Forensic Analysis 4