CySA+ Test Incident Response 3

Question 1

During an incident investigation, an analyst finds evidence that data was exfiltrated via DNS queries. Which technique was likely used?

Accepted Answer

DNS tunneling

Answer

DNS tunneling encodes data within DNS query and response packets to covertly exfiltrate information through DNS protocol.

Question 2

Which chain-of-custody practice is MOST important when collecting digital evidence from a live system?

Accepted Answer

Document every action taken and hash all collected artifacts

Answer

Documenting all actions and hashing artifacts ensures evidence integrity and maintains a defensible chain of custody for legal proceedings.

Question 3

A SOC analyst identifies a process injecting code into a legitimate Windows process (e.g., svchost.exe). Which MITRE ATT&CK technique does this represent?

Accepted Answer

Process injection

Answer

Process injection is a MITRE ATT&CK technique where adversaries inject malicious code into legitimate running processes to evade detection.

Question 4

Which log source would be MOST useful for identifying lateral movement via Pass-the-Hash attacks within a Windows environment?

Accepted Answer

Windows Security Event Log (Event ID 4624)

Answer

Windows Security Event ID 4624 (logon events) with Logon Type 3 and NTLM authentication can indicate Pass-the-Hash lateral movement.

Question 5

An analyst is performing triage on 50 simultaneous alerts. Which approach BEST prioritizes response efforts?

Accepted Answer

Prioritize by asset criticality and potential business impact

Answer

Triaging by asset criticality and business impact ensures the most damaging potential incidents receive immediate attention.

CySA+ Practice Test

CySA+ Practice Test

CySA+ Test Incident Response 3