CS0-003 Incident Response and Management Practice Test 5 — 15 Questions

Question 1

An analyst is performing static analysis on a suspicious executable file. Which of the following would be MOST useful to identify potential malicious behavior without executing the file?

Accepted Answer

Analyzing the import table.. Static analysis involves examining the file without executing it. The import table shows which Windows API functions the executable uses, which can indicate capabilities such as network communication, file operations, or registry modifications.

Answer

Running the file in a sandbox.

Answer

Monitoring network connections during execution.

Answer

Checking the file's digital signature.

Question 2

During a post-incident review, the incident response team identifies that the mean time to detect (MTTD) for incidents is significantly higher than industry benchmarks. Which of the following improvements would most directly reduce MTTD?

Accepted Answer

Implementing automated alerting based on threat intelligence.. MTTD is the average time to detect an incident. Implementing automated alerting and correlation rules from threat intelligence can speed up detection by reducing manual analysis time.

Answer

Increasing the number of forensic analysts on call.

Answer

Conducting more frequent tabletop exercises.

Answer

Rotating credentials after each incident.

Question 3

An analyst is using YARA to create rules for detecting a specific malware strain. Which of the following pieces of information is MOST useful for writing a YARA rule?

Accepted Answer

A unique string within the malware.. YARA rules are based on patterns in the file, such as strings and byte sequences. A unique string found in the malware sample can be used to create a rule that identifies the malware.

Answer

The malware's file size.

Answer

The date the malware was first seen.

Answer

The malware's MD5 hash.

Question 4

A security analyst needs to share threat intelligence with other organizations in a standardized format. Which of the following standards should the analyst use?

Accepted Answer

STIX/TAXII. STIX (Structured Threat Information Expression) is a standardized language for describing threat intelligence, and TAXII (Trusted Automated eXchange of Indicator Information) is a transport mechanism. Together, they enable sharing.

Answer

REST

Answer

SOAP

Answer

SNMP

Question 5

During a ransomware incident, the incident response team needs to preserve evidence before containment. Which of the following actions should be performed BEFORE isolating the infected system from the network?

Accepted Answer

Capture the contents of RAM.. The order of volatility requires capturing volatile data like RAM before shutting down or isolating the system, as isolation may alter or lose memory contents.

Answer

Run an antivirus scan.

Answer

Disable the network interface.

Answer

Capture a forensic image of the hard drive.

Question 6

An organization is experiencing a DDoS attack targeting its web servers. Which of the following is the BEST short-term containment strategy?

Accepted Answer

Reroute traffic through a DDoS mitigation service.. Short-term containment for DDoS often involves rerouting traffic through a scrubbing center or cloud-based DDoS mitigation service that filters malicious traffic.

Answer

Rebuild the web servers from backups.

Answer

Implement rate limiting on the firewall.

Answer

Disable the web server accounts.

Question 7

During a forensic investigation of a compromised Linux server, the analyst needs to acquire memory for analysis. The system is running and the analyst cannot power it off. Which tool is MOST appropriate for acquiring memory in this scenario?

Accepted Answer

LiME. LiME (Linux Memory Extractor) is a tool designed for acquiring memory from Linux systems while they are running, and it can be loaded as a kernel module without shutting down.

Answer

FTK Imager

Answer

WinPmem

Answer

dd

Question 8

An analyst is investigating a suspected data breach. The analyst needs to identify which files were exfiltrated and preserve evidence. According to the order of volatility, which of the following should the analyst capture FIRST?

Accepted Answer

CPU registers and cache. Order of volatility prioritizes capturing volatile data first. CPU registers and cache are the most volatile, then RAM, swap, disk, etc.

Answer

Contents of the hard drive

Answer

Network connections and listening ports

Answer

System logs

Question 9

A security analyst is analyzing a suspicious file using static analysis. The analyst wants to identify imported functions to determine the file's capabilities. Which tool or technique is BEST suited for this task?

Accepted Answer

Analyzing the PE header's import table. PE header analysis includes examining the import table to see which Windows API functions the executable calls, revealing its potential behavior.

Answer

Extracting strings from the file

Answer

Submitting the file to VirusTotal

Answer

Running the file in a sandbox like Cuckoo

Question 10

During dynamic analysis of a malware sample in a sandbox, the analyst observes that the malware attempts to connect to an IP address 198.51.100.23 and modifies the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Which IOC type is the IP address an example of?

Accepted Answer

Network indicator. IP addresses are a common type of indicator of compromise, representing network-based IOCs that can be used for detection.

Answer

File hash

Answer

Email indicator

Answer

Domain name

Question 11

After containing a ransomware incident, the incident response team is conducting post-incident activities. Which action is MOST important to prevent a similar attack in the future?

Accepted Answer

Performing a root cause analysis and implementing remediation. Conducting a root cause analysis identifies the underlying vulnerability or weakness that allowed the attack, enabling targeted remediation.

Answer

Sharing IOCs with other organizations via a threat intelligence platform

Answer

Reimaging all affected systems

Answer

Updating the incident response plan

Question 12

An analyst is investigating a possible data exfiltration incident. The analyst has acquired a memory dump from the compromised system. Which of the following would be the BEST approach to extract evidence of exfiltration?

Accepted Answer

Using a memory analysis framework like Volatility to analyze network connections and process memory. Memory analysis tools like Volatility can extract network connections, process memory, and other artifacts that may show exfiltration activity.

Answer

Calculating the MD5 hash of the memory dump and comparing it to known good hashes

Answer

Searching the memory dump for strings containing 'password'

Answer

Rebooting the system and capturing a new memory dump

Question 13

An organization wants to automate the sharing of threat intelligence with other trusted entities using a standardized protocol. Which protocol is specifically designed for this purpose?

Accepted Answer

TAXII. TAXII (Trusted Automated eXchange of Indicator Information) is a protocol for exchanging cyber threat intelligence in a standardized format, often used with STIX.

Answer

STIX

Answer

REST API

Answer

MISP

Question 14

During the detection and analysis phase of an incident, an analyst identifies a file with a hash that matches a known malware signature. The analyst wants to enrich this IOC with additional context. Which resource is BEST suited for this enrichment?

Accepted Answer

VirusTotal. VirusTotal aggregates antivirus scan results and provides additional context such as file metadata, behavior, and community comments.

Answer

Shodan

Answer

WHOIS lookup

Answer

Passive DNS

Question 15

During a malware outbreak, an incident responder uses YARA rules to detect similar malware across the environment. The responder created a custom YARA rule based on static analysis of the malware sample. Which THREE elements are MOST useful for creating an effective YARA rule for this malware? (Choose THREE.)

Accepted Answer

Unique strings found in the malware binary. YARA rules commonly use strings, PE header characteristics, and file metadata. While YARA can check file size with the filesize condition, it is not a strong indicator for identifying similar malware because it is not unique and can be easily changed. Dynamic behavior, such as sandbox execution results, is not used in static YARA rules.

Answer

The file size of the malware sample

Answer

Behavior observed in a sandbox, such as registry changes