CySA+ Test Incident Response 3 — Questions and Answers
Question 1: During an incident investigation, an analyst finds evidence that data was exfiltrated via DNS queries. Which technique was likely used?
- DNS cache poisoning
- DNS tunneling (Correct answer)
- DNS amplification attack
- DNS zone transfer abuse
Correct answer: DNS tunneling
DNS tunneling encodes data within DNS query and response packets to covertly exfiltrate information through DNS protocol.
Question 2: Which chain-of-custody practice is MOST important when collecting digital evidence from a live system?
- Power off the system before collecting evidence
- Document every action taken and hash all collected artifacts (Correct answer)
- Use the system's built-in backup tools
- Collect evidence directly to a network share for safekeeping
Correct answer: Document every action taken and hash all collected artifacts
Documenting all actions and hashing artifacts ensures evidence integrity and maintains a defensible chain of custody for legal proceedings.
Question 3: A SOC analyst identifies a process injecting code into a legitimate Windows process (e.g., svchost.exe). Which MITRE ATT&CK technique does this represent?
- Credential dumping
- Process injection (Correct answer)
- Scheduled task abuse
- DLL side-loading
Correct answer: Process injection
Process injection is a MITRE ATT&CK technique where adversaries inject malicious code into legitimate running processes to evade detection.
Question 4: Which log source would be MOST useful for identifying lateral movement via Pass-the-Hash attacks within a Windows environment?
- DNS query logs
- Windows Security Event Log (Event ID 4624) (Correct answer)
- Firewall connection logs
- Application error logs
Correct answer: Windows Security Event Log (Event ID 4624)
Windows Security Event ID 4624 (logon events) with Logon Type 3 and NTLM authentication can indicate Pass-the-Hash lateral movement.
Question 5: An analyst is performing triage on 50 simultaneous alerts. Which approach BEST prioritizes response efforts?
- Address alerts in the order they were received
- Prioritize by asset criticality and potential business impact (Correct answer)
- Focus only on alerts with the highest CVSS scores
- Escalate all alerts to senior analysts
Correct answer: Prioritize by asset criticality and potential business impact
Triaging by asset criticality and business impact ensures the most damaging potential incidents receive immediate attention.
Question 6: During post-incident analysis, the team discovers the attacker maintained persistence for 90 days before detection. Which term describes this period?
- Recovery time
- Dwell time (Correct answer)
- Detection lag
- Mean time to respond
Correct answer: Dwell time
Dwell time refers to the duration an attacker remains undetected within a compromised environment after initial intrusion.
Question 7: Which tool is BEST suited for capturing and analyzing volatile memory from a compromised Windows system?
- Wireshark
- Volatility (Correct answer)
- Nmap
- Autopsy
Correct answer: Volatility
Volatility is a memory forensics framework specifically designed to analyze RAM dumps from Windows (and other) systems for malicious artifacts.
CySA+ Test Incident Response 3
During an incident investigation, an analyst finds evidence that data was exfiltrated via DNS queries.
Which technique was likely used?