GCIH Network Forensics & Malware Analysis

Question 1

What is the first step in network forensics after detecting an incident?

Accepted Answer

Preserve evidence and create an incident timeline

Answer

The first step in network forensics after detecting an incident is to preserve evidence to maintain its integrity and prevent alteration or destruction. Simultaneously, creating an incident timeline helps establish a chronological understanding of events, which is vital for reconstructing the attack and supporting any potential legal action.

Question 2

What is the main objective of malware analysis?

Accepted Answer

To understand the malware's behavior and origin

Answer

The main objective of malware analysis is to dissect malicious software to understand its inner workings, capabilities, and how it propagates. This deep understanding is essential for developing effective detection signatures, removal tools, and preventative measures to protect systems from future infections.

Question 3

How can you identify suspicious network traffic during an incident?

Accepted Answer

By analyzing network traffic patterns and anomalies

Answer

Suspicious network traffic often deviates from normal baseline patterns. By continuously monitoring and analyzing network traffic for unusual protocols, destinations, volumes, or behaviors, incident handlers can identify anomalies that may indicate command-and-control communications, data exfiltration, or other malicious activities.

Question 4

Why is timestamp analysis important in network forensics?

Accepted Answer

To create a timeline of events in the attack

Answer

Timestamp analysis is critical in network forensics because it provides a chronological record of events. By examining timestamps on logs, files, and network packets, investigators can reconstruct the sequence of an attack, understand its progression, and pinpoint key moments like initial compromise or data exfiltration.

Question 5

What is the purpose of extracting artifacts from a compromised system?

Accepted Answer

To find evidence of attacker actions

Answer

Extracting artifacts from a compromised system is essential for uncovering evidence of attacker actions. These artifacts, such as log entries, modified files, registry keys, or memory dumps, provide crucial insights into the attacker's methods, tools, and objectives, which aids in effective remediation and future prevention.

(GCIH) GIAC Experienced Incident Handler Practice Test

(GCIH) GIAC Experienced Incident Handler Practice Test

GCIH Network Forensics & Malware Analysis