312-39 Forensic Investigation And Malware Analysis Practice Test 2 — 15 Questions

Question 1

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Accepted Answer

4104. Windows Event ID 4104 is generated by PowerShell's Script Block Logging feature and records the full text of executed script blocks, including obfuscated or dynamically constructed code. This makes it the primary event ID for reconstructing PowerShell-based attacks. Event ID 4104 appears in the 'Microsoft-Windows-PowerShell/Operational' log and is essential for detecting fileless malware and encoded command execution.

Answer

1102

Answer

4688

Answer

4624

Question 2

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Accepted Answer

Dynamic analysis requires a sandbox or isolated environment. Option C is correct because static analysis examines a binary's code, headers, strings, imports, and structure without ever running it, which is its defining characteristic. Option A is correct because dynamic analysis observes the malware's actual behavior at runtime, so it must be executed inside a sandbox or otherwise isolated environment to prevent infection of the host and to safely capture process, file, registry, and network activity. Option B is incorrect because static analysis is not always faster; large or obfuscated/packed binaries can make it slow, while dynamic analysis may complete quickly. Option D is incorrect because static analysis can reveal malicious intent through indicators such as suspicious API imports, embedded strings, or malicious code patterns. Option E is incorrect because dynamic analysis applies to Windows, Linux, macOS, and other platforms, not only Linux systems.

Answer

Static analysis is always faster than dynamic analysis

Answer

Static analysis cannot identify malicious intent

Answer

Dynamic analysis is only used for Linux systems

Question 3

A SOC analyst receives an alert about a suspicious process named 'svchost.exe' running from C:\Users\Public\Downloads. The analyst wants to quickly determine whether the process is malicious by examining its parent process, command line, and loaded modules. Which Sysinternals tool should the analyst use?

Accepted Answer

Process Explorer. Process Explorer is the correct tool because it provides a comprehensive, real-time view of running processes, including parent-child relationships, command-line arguments, and loaded modules. These features allow the analyst to quickly assess whether svchost.exe running from an unusual path is legitimate or malicious, which is critical for rapid triage in a SOC environment.

Answer

Process Monitor

Answer

TCPView

Answer

Autoruns

Question 4

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

Accepted Answer

The file has a high entropy value, especially in the code sections.. High entropy in code sections is a strong indicator of packing because packers compress or encrypt the original executable, resulting in randomized data. Tools like PEiD or Detect It Easy can identify known packers, but entropy analysis is a fundamental first step. In contrast, other options like digital signatures or import counts do not directly correlate with packing and may even suggest the opposite.

Answer

The file size is less than 100 KB.

Answer

The file has a large number of imported functions from kernel32.dll.

Answer

The file contains a digital signature from a known vendor.

Question 5

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

Accepted Answer

netstat -ano. The analyst needs a live mapping of connections to the owning process on a Windows host using only built-in tooling. The netstat utility with the -a, -n, and -o switches enumerates all connections in numeric form and appends the owning PID, allowing direct correlation to PID 4212. None of the other utilities expose socket ownership, so they cannot answer the question.

Answer

nslookup

Answer

arp -a

Answer

tracert

Question 6

A SOC analyst is investigating a suspected compromised Windows 10 workstation. The analyst wants to determine which removable USB storage devices were connected to the host and correlate that activity with a suspicious data exfiltration alert. Which artifact or registry location should the analyst examine FIRST to enumerate historically connected USB mass storage devices?

Accepted Answer

The SYSTEM hive, under ControlSet00X\Enum\USBSTOR. USBSTOR under the SYSTEM hive is the canonical persistent record of USB mass storage devices attached to a Windows system, storing device instance IDs with vendor, product, and revision strings. It survives device removal and reboots, allowing retrospective enumeration. MountPoints2 supplements this per-user, while Policy\Secrets and SAM hold credential and account data unrelated to device history.

Answer

The NTUSER.DAT hive, under Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Answer

The SECURITY hive, under Policy\Secrets

Answer

The SAM hive, under SAM\Domains\Account\Users

Question 7

During malware analysis, a SOC analyst observes that a suspicious executable creates a new file in %TEMP% with a random name, then that file spawns a child process. The analyst wants to determine the exact parent-child process lineage and capture the command line used at launch. Which Windows artifact or tool provides this directly?

Accepted Answer

Sysmon Event ID 1 (Process Create). To establish parent-child lineage and capture the exact command line, the analyst needs a telemetry source that records both. Sysmon Event ID 1 includes ParentImage, ParentCommandLine, Image, CommandLine, and ProcessGuid, enabling full reconstruction of the process tree. Security 4688 may lack command lines, and Prefetch and Amcache provide execution evidence but not lineage or arguments.

Answer

Amcache.hve

Answer

Prefetch files in C:\Windows\Prefetch

Answer

Windows Security Event ID 4688 without command-line auditing enabled

Question 8

A SOC analyst is performing live forensic triage on a Windows Server 2019 host suspected of a credential-dumping attack. The analyst wants to identify whether the LSASS process memory has been accessed by an unauthorized tool in the last 24 hours. Which Windows event log source and event ID should the analyst review?

Accepted Answer

Sysmon operational log, event ID 10. Sysmon event ID 10 (ProcessAccess) captures handle opens to other processes, including the source image, target image, and granted access rights. When Sysmon is configured with a rule for lsass.exe, it provides direct evidence of credential-dumping tools accessing LSASS. Security 4688 and 4624 and System 7045 do not record process-to-process handle operations, so they cannot answer the specific question.

Answer

Security log, event ID 4624

Answer

System log, event ID 7045

Answer

Security log, event ID 4688

Question 9

A SOC analyst is performing dynamic malware analysis in an isolated sandbox. The analyst wants to observe the malware's file system and Registry modifications in real time and then roll back the system to a clean state afterward. Which approach best supports this requirement?

Accepted Answer

Run the sample inside a virtual machine configured with a snapshot that is reverted after each analysis run. Dynamic analysis in an isolated VM with a pre-execution snapshot lets the analyst watch file system and Registry writes live using monitoring tools, then discard all changes by reverting. The snapshot guarantees a clean baseline for the next run. Running on production hardware, relying on public scanners, or performing only static review cannot satisfy both the real-time observation and rollback requirements.

Answer

Analyze the sample with a disassembler and annotate the file-system API calls statically

Answer

Upload the sample to a public multi-engine scanning service and review the behavioral report

Answer

Execute the sample directly on the analyst's production workstation while monitoring with Process Monitor

Question 10

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

Accepted Answer

Run the sample in a debugger with breakpoints on LoadLibrary and GetProcAddress, then inspect the string arguments passed to those functions. Dynamic resolution through LoadLibrary and GetProcAddress is the standard mechanism behind sparse import tables, so instrumenting those two functions in a debugger recovers the module and procedure names as they are requested. Hash lookups, section size comparisons, and string extraction are triage techniques that do not expose the runtime resolution sequence.

Answer

Parse the PE section table and compare the raw size against the virtual size of each section

Answer

Extract printable ASCII and Unicode strings from the binary and filter for known Windows API names

Answer

Compute the file's MD5 and SHA-256 hashes and submit them to a public multi-engine scanning service

Question 11

A SOC analyst is conducting dynamic malware analysis on a suspicious binary in an isolated sandbox. The analyst observes that the malware creates a new file in the Startup folder and modifies a Run key in the registry. Which TWO artifacts should the analyst collect to document the persistence mechanisms for the forensic report? (Choose two.)

Accepted Answer

The full path and filename of the file created in the Startup folder. To document persistence, the analyst must record the exact file path in the Startup folder and the full registry key path with value data under the Run key. These artifacts provide actionable evidence for remediation and satisfy the forensic requirement to describe how the malware maintains execution. The other options are unrelated to persistence mechanisms.

Answer

The MD5 hash of the sandbox host operating system ISO

Answer

The list of all open network ports on the sandbox at the time of analysis

Answer

The screen resolution and color depth of the sandbox desktop

Question 12

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

Accepted Answer

A private executable memory region inside a legitimate process marked PAGE_EXECUTE_READWRITE. Injected code typically appears as executable private memory with write permissions inside a host process, or as a thread whose start address is outside any mapped module. Both artifacts deviate from normal process structure and are surfaced by memory forensics plugins. Signed DLLs, handle counts, and ordinary waiting threads are normal conditions and do not by themselves demonstrate injection.

Answer

A user-mode process with a single thread that is currently in a wait state

Answer

A signed Microsoft DLL loaded at its expected base address

Answer

A process with a high handle count and many open Registry keys

Question 13

A SOC analyst is triaging a Linux web server that is suspected of hosting a web shell used by an attacker to maintain access. The analyst has a disk image and needs to identify indicators of the web shell and its activity. Which TWO artifacts should the analyst prioritize examining? (Choose two.)

Accepted Answer

The web server access logs, looking for POST requests with unusual parameters or anomalous response sizes and user agents. Web shells manifest in two places: the web server access log, where command execution appears as anomalous POST traffic to a script, and the document root itself, where the injected file can be found by comparing against a baseline or package checksums. Kernel, SSH, and credential artifacts address unrelated intrusion vectors and do not evidence the web shell.

Answer

The /etc/shadow file, verifying password hash algorithms and account expiration fields

Answer

The systemd journal entries for the SSH daemon, counting failed authentication attempts per source IP

Answer

The kernel ring buffer, searching for segmentation faults and out-of-memory kill messages

Question 14

A SOC analyst receives a suspicious PDF attachment from a user. The analyst wants to quickly determine whether the PDF contains JavaScript or an embedded executable without executing it. Which approach is most appropriate?

Accepted Answer

Use a PDF parser such as pdfid or pdf-parser to inspect object types and keywords. Static PDF inspection with pdfid or pdf-parser reveals keywords such as /JavaScript, /JS, /OpenAction, and /EmbeddedFile without executing the file. This is the fastest and safest way to determine whether the PDF contains JavaScript or an embedded executable. Sandbox execution, hash reputation, and metadata extraction do not directly answer the structural question.

Answer

Extract the PDF's metadata using exiftool and review the author field

Answer

Submit the PDF hash to a public malware repository and rely on the detection ratio

Answer

Open the PDF in a sandboxed virtual machine and observe network traffic

Question 15

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should the analyst take?

Accepted Answer

Use a utility such as certutil -hashfile or sha256sum to compute the file's hash. The analyst needs a cryptographic hash without executing the sample. Built-in utilities such as certutil -hashfile on Windows or sha256sum on Linux generate MD5, SHA-1, or SHA-256 values safely and quickly, enabling comparison against threat intelligence. Sandbox execution, hex inspection, and public submissions either execute the file, fail to produce a hash, or expose the sample unnecessarily.

Answer

Submit the binary to a public multi-engine scanning service and read the detection names

Answer

Run the binary in a sandbox and record the hash from the sandbox report

Answer

Open the binary in a hex editor and visually inspect the first bytes