Courseiva

CCNA Forensic Investigation And Malware Analysis Questions

32 questions · Forensic Investigation And Malware Analysis · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQhard

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

A.Parse the PE section table and compare the raw size against the virtual size of each section
B.Run the sample in a debugger with breakpoints on LoadLibrary and GetProcAddress, then inspect the string arguments passed to those functions
C.Extract printable ASCII and Unicode strings from the binary and filter for known Windows API names
D.Compute the file's MD5 and SHA-256 hashes and submit them to a public multi-engine scanning service
AnswerB

Dynamic API resolution almost always relies on LoadLibrary plus GetProcAddress to locate function pointers at runtime, so these calls leave no static import entries. Breaking on both functions and reading the module name and procedure name arguments from the stack or registers exposes exactly which APIs the malware resolves, which can then be mapped back to the suspicious behaviors observed during execution.

Why this answer

Dynamic resolution through LoadLibrary and GetProcAddress is the standard mechanism behind sparse import tables, so instrumenting those two functions in a debugger recovers the module and procedure names as they are requested. Hash lookups, section size comparisons, and string extraction are triage techniques that do not expose the runtime resolution sequence.

Exam trap

The trap here is expecting the API names to appear as plaintext strings, when malware frequently stores them as hashes that only match after the runtime resolution routine computes them.

Practice this question →
2
MCQeasy

A SOC analyst has acquired a forensic image of a compromised Windows host. To establish a defensible timeline of attacker activity, the analyst needs to place file system timestamps into a consistent, sortable sequence. Which step is essential before correlating timestamps across artifacts?

A.Reboot the acquired image so that the operating system refreshes its internal clock before analysis
B.Recalculate file hashes for every artifact so that timestamp changes can be detected
C.Convert all timestamps to the Windows FILETIME format regardless of the source operating system
D.Normalize all timestamps to a common time zone and note clock offsets between the host and the analyst's reference time
AnswerD

Timestamps from different artifacts may be recorded in UTC or local time, and the host clock may be skewed, so normalizing to a single time zone and documenting offset corrections is required for a valid sequence. Without this step, events can appear out of order and the reconstructed timeline becomes unreliable during the investigation.

Why this answer

A reliable timeline requires all timestamps to be expressed in a common time zone with documented corrections for clock skew between the suspect host and a trusted reference. Hash recalculation, rebooting the image, and format conversion do not address temporal consistency and, in the case of rebooting, actively contaminate the evidence.

Exam trap

The trap here is believing that converting timestamps to a single file format fixes timeline problems, when the real issues are time zone normalization and host clock offset.

Practice this question →
3
MCQeasy

A SOC analyst is performing static analysis on a suspicious Windows Portable Executable (PE) file. The analyst wants to quickly determine the compile timestamp of the binary to assess whether it matches the reported incident timeline. Which field in the PE header should the analyst examine?

A.SizeOfImage in the IMAGE_OPTIONAL_HEADER
B.TimeDateStamp in the IMAGE_FILE_HEADER
C.AddressOfEntryPoint in the IMAGE_OPTIONAL_HEADER
D.CheckSum in the IMAGE_OPTIONAL_HEADER
AnswerB

The TimeDateStamp field in the IMAGE_FILE_HEADER of a PE file contains the time the file was compiled, expressed as a Unix timestamp. It is a standard part of the COFF file header and can be viewed with tools like PEview or CFF Explorer. This field helps analysts correlate the binary's creation time with incident timelines.

Why this answer

The TimeDateStamp field in the IMAGE_FILE_HEADER of a PE file records the compilation time as a Unix timestamp. Analysts can convert this value to a human-readable date to compare against incident timelines. While timestamps can be manipulated, it remains a quick initial indicator for static analysis.

Exam trap

The trap here is confusing header fields that describe size or entry point with the timestamp field, which is specifically named TimeDateStamp.

Practice this question →
4
Multi-Selecthard

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

Select 2 answers
A.A user-mode process with a single thread that is currently in a wait state
B.A private executable memory region inside a legitimate process marked PAGE_EXECUTE_READWRITE
C.A signed Microsoft DLL loaded at its expected base address
D.An unlinked thread whose start address falls outside any module mapped in the process
E.A process with a high handle count and many open Registry keys
AnswersB, D

Legitimate code pages are typically mapped as images with execute-read permissions. A private region with both write and execute permissions inside a normally non-executable host process strongly suggests injected shellcode. Memory forensics tools flag RWX private regions because they are a common hallmark of reflective loading and process hollowing, making this a direct indicator of injection.

Why this answer

Injected code typically appears as executable private memory with write permissions inside a host process, or as a thread whose start address is outside any mapped module. Both artifacts deviate from normal process structure and are surfaced by memory forensics plugins. Signed DLLs, handle counts, and ordinary waiting threads are normal conditions and do not by themselves demonstrate injection.

Exam trap

The trap here is equating any unusual process characteristic, such as high handle counts or idle threads, with injection, when the reliable indicators are anomalous memory permissions and orphaned execution addresses.

Practice this question →
5
Multi-Selectmedium

A SOC analyst is conducting dynamic malware analysis on a suspicious binary in an isolated sandbox. The analyst observes that the malware creates a new file in the Startup folder and modifies a Run key in the registry. Which TWO artifacts should the analyst collect to document the persistence mechanisms for the forensic report? (Choose two.)

Select 2 answers
A.The MD5 hash of the sandbox host operating system ISO
B.The list of all open network ports on the sandbox at the time of analysis
C.The full path and filename of the file created in the Startup folder
D.The screen resolution and color depth of the sandbox desktop
E.The registry key path and value data modified under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
AnswersC, E

The Startup folder path and filename are direct evidence of a persistence mechanism. Documenting the exact location, such as C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malware.lnk, allows responders to remove the file and understand how the malware survives reboot. This artifact is essential for the forensic report because it ties the malware to a specific autostart location.

Why this answer

To document persistence, the analyst must record the exact file path in the Startup folder and the full registry key path with value data under the Run key. These artifacts provide actionable evidence for remediation and satisfy the forensic requirement to describe how the malware maintains execution. The other options are unrelated to persistence mechanisms.

Exam trap

The trap here is selecting general system or network details instead of the specific file and registry artifacts that directly represent the persistence mechanisms observed.

Practice this question →
6
MCQhard

During malware analysis, a SOC analyst observes that a suspicious executable creates a new file in %TEMP% with a random name, then that file spawns a child process. The analyst wants to determine the exact parent-child process lineage and capture the command line used at launch. Which Windows artifact or tool provides this directly?

A.Amcache.hve
B.Prefetch files in C:\Windows\Prefetch
C.Windows Security Event ID 4688 without command-line auditing enabled
D.Sysmon Event ID 1 (Process Create)
AnswerD

Sysmon Event ID 1 records process creation including the full command line, parent process ID, parent image, hashes, and user context. This directly answers the lineage and command-line question. If Sysmon is deployed with the appropriate configuration, the analyst can pivot from the initial executable to the dropped file and its child process, capturing the exact invocation used.

Why this answer

To establish parent-child lineage and capture the exact command line, the analyst needs a telemetry source that records both. Sysmon Event ID 1 includes ParentImage, ParentCommandLine, Image, CommandLine, and ProcessGuid, enabling full reconstruction of the process tree. Security 4688 may lack command lines, and Prefetch and Amcache provide execution evidence but not lineage or arguments.

Exam trap

The trap here is treating any process-creation log as sufficient, when 4688 often omits the command line and artifacts like Prefetch or Amcache never record parent-child relationships.

Practice this question →
7
Multi-Selectmedium

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Select 3 answers
A.Memory usage patterns
B.Embedded strings (e.g., C2 domains, IP addresses)
C.File hash (MD5/SHA256)
D.Network latency to the server
E.Import Address Table (IAT) entries
AnswersB, C, E

Embedded strings expose hard-coded artefacts such as C2 domains, IP addresses, file paths and registry keys without executing the sample, satisfying the static-analysis constraint. Unlike dynamic techniques, string extraction reads the binary's raw bytes directly, revealing infrastructure the malware author left in plaintext or lightly obfuscated.

Why this answer

Static analysis examines a binary without executing it, so the analyst inspects its contents and metadata directly. Option B is correct because embedded strings often reveal hardcoded C2 domains, IP addresses, URLs, file paths, and other artifacts that expose the malware's intent and infrastructure. Option C is correct because computing cryptographic hashes such as MD5 or SHA256 provides a unique fingerprint used to identify, correlate, and look up the sample in threat-intelligence databases like VirusTotal without running it.

Option E is correct because the Import Address Table lists the Windows API functions the binary references (e.g., CreateRemoteThread, InternetOpen), which strongly hints at its capabilities such as process injection or network communication. Option A is not a static indicator since memory usage patterns only emerge during dynamic execution or runtime monitoring. Option D is likewise dynamic, as network latency to a server can only be measured by executing the sample and observing live traffic.

Exam trap

EC-Council 312-39 often tests the static-versus-dynamic analysis boundary — candidates pick memory usage or network latency because they sound like malware indicators, missing that those require execution.

Practice this question →
8
MCQeasy

A SOC analyst receives a suspicious PDF attachment from a user. The analyst wants to quickly determine whether the PDF contains JavaScript or an embedded executable without executing it. Which approach is most appropriate?

A.Extract the PDF's metadata using exiftool and review the author field
B.Use a PDF parser such as pdfid or pdf-parser to inspect object types and keywords
C.Submit the PDF hash to a public malware repository and rely on the detection ratio
D.Open the PDF in a sandboxed virtual machine and observe network traffic
AnswerB

pdfid and pdf-parser are static analysis tools that examine PDF structure without rendering or executing it. They can list keywords like /JavaScript, /JS, /OpenAction, and /EmbeddedFile, which indicate potential malicious content. This directly answers whether the PDF contains JavaScript or an embedded executable, and it is fast and safe.

Why this answer

Static PDF inspection with pdfid or pdf-parser reveals keywords such as /JavaScript, /JS, /OpenAction, and /EmbeddedFile without executing the file. This is the fastest and safest way to determine whether the PDF contains JavaScript or an embedded executable. Sandbox execution, hash reputation, and metadata extraction do not directly answer the structural question.

Exam trap

The trap here is reaching for dynamic execution or hash reputation when the question specifically asks for a quick, non-executing inspection of the PDF's internal objects.

Practice this question →
9
Multi-Selecthard

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Select 2 answers
A.Dynamic analysis requires a sandbox or isolated environment
B.Static analysis is always faster than dynamic analysis
C.Static analysis does not require executing the binary
D.Static analysis cannot identify malicious intent
E.Dynamic analysis is only used for Linux systems
AnswersA, C

Dynamic analysis executes the sample and observes its behaviour, so it demands a sandbox or isolated environment to contain infection. Static analysis inspects code without running it. This containment requirement is a defining operational difference between the two approaches.

Why this answer

Option C is correct because static analysis examines a binary's code, headers, strings, imports, and structure without ever running it, which is its defining characteristic. Option A is correct because dynamic analysis observes the malware's actual behavior at runtime, so it must be executed inside a sandbox or otherwise isolated environment to prevent infection of the host and to safely capture process, file, registry, and network activity. Option B is incorrect because static analysis is not always faster; large or obfuscated/packed binaries can make it slow, while dynamic analysis may complete quickly.

Option D is incorrect because static analysis can reveal malicious intent through indicators such as suspicious API imports, embedded strings, or malicious code patterns. Option E is incorrect because dynamic analysis applies to Windows, Linux, macOS, and other platforms, not only Linux systems.

Exam trap

The trap here is confusing the capabilities of static and dynamic analysis, such as assuming static analysis cannot detect malicious intent or that dynamic analysis is platform-specific, leading candidates to overlook the core execution and isolation differences.

Practice this question →
10
MCQeasy

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

A.Malwarebytes Nebula
B.VirusTotal
C.Nessus
D.Splunk ES
AnswerB

VirusTotal aggregates results from over seventy antivirus engines and file-analysis tools, letting the analyst submit a hash and immediately see prior community detections without uploading the binary itself. This directly satisfies the requirement to check a file hash's reputation across dozens of engines, which no single-vendor sandbox or SIEM can match.

Why this answer

VirusTotal is the industry-standard platform for checking a file hash (MD5, SHA-1, SHA-256) against dozens of antivirus engines, sandboxes, and threat intelligence sources simultaneously. Analysts paste the hash and instantly see detection ratios, behavioral reports, and community comments. It is the de facto first stop for file reputation during malware triage.

Exam trap

The trap is confusing endpoint protection consoles (Malwarebytes), vulnerability scanners (Nessus), or SIEMs (Splunk ES) with a multi-engine file reputation service — the exam expects you to know VirusTotal's unique aggregation role.

How to eliminate wrong answers

Option A is wrong because Malwarebytes Nebula is an endpoint protection management console, not a multi-engine file reputation service — it only reflects Malwarebytes' own detection. Option C is wrong because Nessus is a vulnerability scanner used for configuration and CVE assessment, not file hash reputation. Option D is wrong because Splunk ES is a SIEM platform for log correlation and security analytics, not a public file-reputation database.

Practice this question →
11
MCQmedium

A SOC analyst is examining a Windows 10 workstation suspected of malware infection. During live response, the analyst needs to capture the current state of network connections, associated process IDs, and executable paths to identify potential command-and-control communication. Which native Windows command should the analyst run to obtain this information?

A.nbtstat -c
B.arp -a
C.ipconfig /displaydns
D.netstat -anob
AnswerD

The netstat command with -a displays all connections and listening ports, -n shows addresses and port numbers in numerical form, -o includes the owning process ID, and -b shows the executable involved in creating each connection. This provides the process-to-connection mapping needed to identify malicious network activity on the live workstation.

Why this answer

The netstat command with the -a, -n, -o, and -b switches provides a comprehensive view of all active connections and listening ports, includes numerical addresses, maps each connection to its owning process ID, and reveals the executable name. This is essential for live response on a Windows workstation to quickly identify suspicious processes communicating over the network.

Exam trap

The trap here is confusing tools that enumerate network artifacts with those that provide process attribution, leading an analyst to choose a command that lacks the -o and -b switches.

Practice this question →
12
MCQmedium

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

A.Autoruns
B.TCPView
C.Process Explorer
D.Process Monitor
AnswerD

Process Monitor captures real-time file system, registry and process/thread activity in a single unified event stream, letting you filter by process name to see precisely which files and registry keys the persistent malware touches as it executes.

Why this answer

Process Monitor (Procmon) is the Sysinternals tool that captures real-time file system, registry, and network activity, showing exactly which files and registry keys a process touches. It provides detailed event properties including process name, PID, operation, path, result, and detail. This makes it the correct choice for observing a persistent malware process's interactions.

Exam trap

312-39 often tests the confusion between Process Explorer (static process details) and Process Monitor (real-time file/registry/network activity), so candidates who see 'process' in the name pick Process Explorer.

How to eliminate wrong answers

Option A is wrong because Autoruns shows autostart locations and persistence points, not real-time file/registry access. Option B is wrong because TCPView displays TCP/UDP endpoints and connections, not file or registry operations. Option C is wrong because Process Explorer shows process tree, handles, DLLs, and memory, but not a live stream of file and registry access events.

Practice this question →
13
MCQeasy

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

A.1102
B.4104
C.4688
D.4624
AnswerB

Event ID 4104 records PowerShell script block logging, capturing the actual command text executed. It fires when PowerShell logs a script block to the operational log, giving analysts the decoded commands. Other IDs cover engine lifecycle or module loading, not executed command blocks.

Why this answer

Windows Event ID 4104 is generated by PowerShell's Script Block Logging feature and records the full text of executed script blocks, including obfuscated or dynamically constructed code. This makes it the primary event ID for reconstructing PowerShell-based attacks. Event ID 4104 appears in the 'Microsoft-Windows-PowerShell/Operational' log and is essential for detecting fileless malware and encoded command execution.

Exam trap

The trap is confusing process-creation logging (4688) with script-block logging (4104) — 4688 shows that powershell.exe ran, but only 4104 reveals what code it actually executed.

How to eliminate wrong answers

Option A is wrong because Event ID 1102 is the Security log event indicating the audit log was cleared — it signals anti-forensic activity, not PowerShell execution. Option C is wrong because Event ID 4688 logs process creation (including the command line if audit policy is enabled), but it does not capture the full script block content executed inside PowerShell. Option D is wrong because Event ID 4624 is a successful logon event in the Security log, unrelated to PowerShell command execution.

Practice this question →
14
Multi-Selectmedium

A SOC analyst is conducting memory forensics on a compromised Windows host using Volatility 3. The analyst needs to identify malicious processes that may be hiding using rootkit techniques. Which two Volatility 3 plugins should the analyst use to detect hidden or unlinked processes? (Choose two.)

Select 2 answers
A.windows.netscan
B.windows.psscan
C.windows.pslist
D.windows.malfind
E.windows.dlllist
AnswersB, C

The windows.psscan plugin scans memory for pool tags associated with process objects, allowing it to find processes that may have been unlinked from the active process list by rootkits. It can detect hidden or terminated processes that are not visible in windows.pslist. This makes it essential for identifying stealthy malware that attempts to hide its process.

Why this answer

To detect hidden processes, analysts compare the output of windows.pslist, which shows processes linked in the active list, with windows.psscan, which scans memory for process objects regardless of list linkage. Discrepancies between the two can reveal processes unlinked by rootkits. These two plugins together provide a robust method for uncovering stealthy processes in memory forensics.

Exam trap

The trap here is assuming that windows.malfind or windows.netscan can directly reveal hidden processes, when they focus on memory anomalies or network artifacts instead.

Practice this question →
15
Multi-Selectmedium

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Select 2 answers
A.Browser history files
B.Registry hive files on disk
C.Active network connections
D.Hard drive partition table
E.System RAM contents
AnswersC, E

Active network connections exist only while sessions remain open; they disappear once endpoints close or the host reboots. Capturing connection tables early preserves volatile evidence such as remote IPs and ports, satisfying the order-of-volatility requirement.

Why this answer

Option C (Active network connections) is correct because running connections exist only in memory and in the kernel's network state tables; once the system is powered off or the connection closes, that state is lost, so it must be captured first with tools like netstat, ss, or tcpdump. Option E (System RAM contents) is correct because RAM is the most volatile evidence of all—it holds running processes, encryption keys, open files, and network buffers that vanish the instant power is removed, making a memory image (e.g., via FTK Imager or WinPmem) a top priority. The unmarked options are not volatile: browser history files (A) and registry hive files (B) reside on disk and persist after shutdown, and the hard drive partition table (D) is likewise stored on the disk's master boot record or GPT, remaining intact until the drive is modified.

Exam trap

The trap is assuming any file on the system is volatile; candidates must distinguish disk-resident artifacts (browser history, registry hives, partition tables) from truly volatile state (RAM, network connections).

Practice this question →
16
MCQhard

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

A.Calculate a cryptographic hash of both
B.Mount the image read-write
C.Run an antivirus scan
D.Rename the file
AnswerA

Hashing both source and copy with the same algorithm (SHA-256) produces matching digests, proving bit-for-bit integrity and that no alteration occurred during acquisition. This satisfies the stem's requirement to verify evidence integrity immediately after copying, establishing the copy's admissibility as an exact duplicate.

Why this answer

Immediately after imaging the original media, the examiner must compute a cryptographic hash (e.g., SHA-256 or MD5) of both the original and the forensic copy and compare them. Matching hashes prove the copy is a bit-for-bit duplicate and that the original was not altered during acquisition, establishing the chain of custody and evidentiary integrity. This is the foundational step for admissibility in legal proceedings.

Exam trap

The trap is picking an action that seems investigative (antivirus scan, mounting) but actually contaminates evidence — candidates forget that integrity verification via hashing must come before any analysis.

How to eliminate wrong answers

Option B is wrong because mounting the image read-write risks modifying the evidence and destroying its integrity — forensic images should be mounted read-only or write-blocked. Option C is wrong because running an antivirus scan on the evidence can quarantine or alter files, contaminating the image and breaking hash verification. Option D is wrong because renaming the file is a cosmetic action that does nothing to verify integrity and could even confuse chain-of-custody documentation.

Practice this question →
17
MCQmedium

A SOC analyst is performing dynamic analysis of a suspicious Windows binary in an isolated lab. The analyst wants to observe the sample's interaction with the file system, registry, and network in real time, and also capture the arguments passed to Windows API calls. Which monitoring approach best provides this combined visibility?

A.Run the binary and review the Windows Security event log for process creation and object access entries
B.Deploy an API-monitoring and sandboxing tool such as Cuckoo Sandbox or a similar automated analysis platform that records API calls, file, registry, and network activity
C.Capture full packet capture on the lab network segment and analyze it with a protocol analyzer
D.Use a disassembler to statically review the binary's code and identify the API calls it references in the import table
AnswerB

Automated sandboxing platforms instrument API calls and collect file system, registry, and network telemetry into a single correlated report, which is exactly the combined visibility the analyst needs. They also capture function arguments and often include behavioral signatures, making them the most efficient way to observe a sample's real-time interactions without manually wiring multiple monitors together.

Why this answer

An automated sandbox or API-monitoring platform correlates API calls with their arguments and simultaneously logs file, registry, and network activity, matching all of the analyst's stated requirements in one workflow. Event logs, static disassembly, and packet capture each cover only a subset and cannot provide the combined real-time behavioral view.

Exam trap

The trap here is treating full packet capture as sufficient dynamic analysis, when network telemetry alone misses host-side file, registry, and API argument evidence.

Practice this question →
18
Multi-Selecteasy

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Select 2 answers
A.The color of the hard drive casing
B.The name of the individual collecting the evidence
C.The CPU manufacturer
D.The system temperature at the time
E.The date and time of collection
AnswersB, E

Chain of Custody requires recording who handled the evidence, so documenting the collector's name establishes accountability and links the artefact to a responsible person. This identity record, alongside timestamps and transfer details, proves the evidence remained unaltered from seizure onward.

Why this answer

Option B is correct because Chain of Custody documentation must identify the person who collected or handled the evidence, establishing accountability for every transfer and ensuring the evidence can be traced to a responsible individual. Option E is correct because the date and time of collection are essential custody metadata that establish when the evidence was seized, helping prove it was not altered or tampered with before analysis. Together, the collector's identity and the collection timestamp are core elements required to demonstrate an unbroken custody trail.

Options A, C, and D are incorrect because hard drive casing color, CPU manufacturer, and system temperature are irrelevant hardware or environmental details that do not establish who handled the evidence or when it was collected.

Exam trap

The trap is selecting technical-sounding but irrelevant details (CPU manufacturer, drive color, temperature) instead of the two legally required custody elements — who collected it and when — which are the foundation of evidence admissibility.

Practice this question →
19
MCQmedium

A SOC analyst receives an alert about a suspicious process named 'svchost.exe' running from C:\Users\Public\Downloads. The analyst wants to quickly determine whether the process is malicious by examining its parent process, command line, and loaded modules. Which Sysinternals tool should the analyst use?

A.Process Explorer
B.Process Monitor
C.TCPView
D.Autoruns
AnswerA

Process Explorer provides a hierarchical view of processes, including parent-child relationships, command-line arguments, and loaded DLLs. In this scenario, the analyst can immediately see that svchost.exe is running from an unusual path and check its parent process (e.g., explorer.exe instead of services.exe), which is a strong indicator of compromise.

Why this answer

Process Explorer is the correct tool because it provides a comprehensive, real-time view of running processes, including parent-child relationships, command-line arguments, and loaded modules. These features allow the analyst to quickly assess whether svchost.exe running from an unusual path is legitimate or malicious, which is critical for rapid triage in a SOC environment.

Exam trap

The trap here is assuming that any Sysinternals tool can show process details, but only Process Explorer offers the combined view of parent, command line, and modules needed for this specific triage.

Practice this question →
20
MCQhard

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

A.Use an SSL/TLS intercepting proxy
B.Use Nmap to scan for open ports
C.Use Wireshark to brute force the key
D.Analyze the payload in a debugger
AnswerA

An SSL/TLS intercepting proxy terminates the malware's TLS session and re-establishes a separate one to the destination, decrypting content in transit. This satisfies the stem's constraint of inspecting encrypted C2 traffic without possessing the malware's private key, since the proxy presents its own trusted certificate to the client.

Why this answer

An SSL/TLS intercepting proxy sits between the malware and the C2 server, terminating the TLS session on both sides using a trusted CA certificate installed on the endpoint. This allows the analyst to decrypt and inspect the plaintext HTTP or custom protocol inside the TLS tunnel without possessing the malware's private key. It is the standard technique for inspecting encrypted C2 traffic in a controlled lab or proxy-enabled environment.

Exam trap

The trap is assuming Wireshark can decrypt TLS if you have the capture; candidates forget that without the session key or private key, captured TLS traffic remains opaque, and only an intercepting proxy or endpoint key extraction can reveal plaintext.

How to eliminate wrong answers

Option B is wrong because Nmap only discovers open ports and services; it cannot decrypt or inspect encrypted payload content. Option C is wrong because Wireshark cannot brute-force TLS session keys in any practical timeframe; modern TLS uses ephemeral Diffie-Hellman keys that are not recoverable from captured traffic. Option D is wrong because a debugger analyzes process memory and code execution, not network traffic content, and would not decrypt the C2 channel.

Practice this question →
21
Multi-Selecthard

A SOC analyst is triaging a Linux web server that is suspected of hosting a web shell used by an attacker to maintain access. The analyst has a disk image and needs to identify indicators of the web shell and its activity. Which TWO artifacts should the analyst prioritize examining? (Choose two.)

Select 2 answers
A.The web server access logs, looking for POST requests with unusual parameters or anomalous response sizes and user agents
B.The /etc/shadow file, verifying password hash algorithms and account expiration fields
C.The web-accessible directories, comparing file modification times and contents against a known-good baseline or package checksums
D.The systemd journal entries for the SSH daemon, counting failed authentication attempts per source IP
E.The kernel ring buffer, searching for segmentation faults and out-of-memory kill messages
AnswersA, C

Web shell interaction typically appears as repeated POST requests to a single script with command-like parameters and consistent response lengths that differ from normal traffic. Analyzing access logs for these patterns, odd user agents, and requests to recently modified scripts can reveal the initial upload and subsequent command execution, directly supporting identification of the web shell's activity timeline.

Why this answer

Web shells manifest in two places: the web server access log, where command execution appears as anomalous POST traffic to a script, and the document root itself, where the injected file can be found by comparing against a baseline or package checksums. Kernel, SSH, and credential artifacts address unrelated intrusion vectors and do not evidence the web shell.

Exam trap

The trap here is gravitating toward system-level logs like dmesg or sshd because they are familiar, when the decisive evidence for a web shell lives in the web layer.

Practice this question →
22
MCQmedium

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

A.Procmon
B.Cuckoo Sandbox
C.PEview
D.x64dbg
AnswerC

PEview parses the Portable Executable structure, displaying the import table, embedded strings and section headers directly from disk. It performs no execution, satisfying the static-analysis constraint, unlike dynamic tools such as sandboxes or debuggers that require running the sample.

Why this answer

PEview is a static analysis tool that parses the Portable Executable (PE) file format and displays its headers, import table, export table, sections, and embedded strings without running the binary. Since the analyst wants to inspect imports, strings, and headers without executing code, PEview is the correct choice. It reads the on-disk structure of the executable directly, making it safe for malware triage.

Exam trap

The trap here is confusing static analysis tools with dynamic analysis tools; candidates often pick Procmon or Cuckoo because they are familiar malware tools, but both require executing the sample, which the question explicitly forbids.

How to eliminate wrong answers

Option A is wrong because Procmon is a runtime monitoring tool that observes file, registry, and process activity as code executes, which violates the requirement to avoid execution. Option B is wrong because Cuckoo Sandbox is a dynamic analysis environment that deliberately executes malware in an isolated VM to observe behavior. Option D is wrong because x64dbg is a debugger that loads and runs the executable in a controlled manner, which is dynamic analysis, not static inspection.

Practice this question →
23
MCQhard

During a forensic investigation of a compromised Windows server, an analyst discovers an alternate data stream (ADS) attached to a legitimate system file. The analyst wants to extract the hidden content for malware analysis. Which Windows command should the analyst use to view the contents of the ADS?

A.attrib filename
B.dir /r filename
C.icacls filename
D.more < filename:streamname
AnswerD

The more command with input redirection from the file and stream name (filename:streamname) reads and displays the contents of the specified alternate data stream. This is a native Windows method to access ADS content without specialized tools, allowing the analyst to examine hidden data that may contain malware or exfiltrated information.

Why this answer

Alternate data streams are a feature of NTFS that allows additional data to be attached to a file without appearing in normal directory listings. To view the contents of an ADS, an analyst can use the more command with input redirection, specifying the file and stream name separated by a colon. This native method avoids the need for third-party tools and works directly in the command prompt.

Exam trap

The trap here is assuming that listing ADS with dir /r also displays their contents, when it only shows stream names and sizes.

Practice this question →
24
MCQmedium

A SOC analyst is performing dynamic malware analysis in an isolated sandbox. The analyst wants to observe the malware's file system and Registry modifications in real time and then roll back the system to a clean state afterward. Which approach best supports this requirement?

A.Analyze the sample with a disassembler and annotate the file-system API calls statically
B.Upload the sample to a public multi-engine scanning service and review the behavioral report
C.Execute the sample directly on the analyst's production workstation while monitoring with Process Monitor
D.Run the sample inside a virtual machine configured with a snapshot that is reverted after each analysis run
AnswerD

A VM snapshot captures the disk and memory state before execution, so all file system and Registry changes are isolated to the guest. After observing behavior with tools like Procmon and Regshot, the analyst reverts to the snapshot, restoring a clean baseline. This provides both real-time visibility and reliable rollback without contaminating the host.

Why this answer

Dynamic analysis in an isolated VM with a pre-execution snapshot lets the analyst watch file system and Registry writes live using monitoring tools, then discard all changes by reverting. The snapshot guarantees a clean baseline for the next run. Running on production hardware, relying on public scanners, or performing only static review cannot satisfy both the real-time observation and rollback requirements.

Exam trap

The trap here is believing a public sandbox report or static disassembly substitutes for controlled local execution, when neither supports interactive observation plus guaranteed snapshot rollback.

Practice this question →
25
MCQhard

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

A.Wireshark
B.Netcat
C.Nmap
D.INetSim
AnswerD

INetSim simulates common internet services, including DNS, on a local host. It answers the malware's DNS queries with the analysis machine's address, redirecting traffic there for observation. This satisfies the requirement to intercept resolution without touching real DNS infrastructure.

Why this answer

INetSim is a suite for simulating common internet services, including DNS, HTTP, and SMTP, and is specifically designed for malware analysis to intercept and redirect traffic. It can simulate a DNS server response, allowing the analyst to redirect the malware's DNS queries to a local analysis machine. This enables safe observation of the malware's network behavior without contacting real external servers.

Exam trap

The trap is assuming that packet capture tools like Wireshark can actively simulate DNS responses, when they can only passively observe traffic. Candidates must distinguish between passive monitoring and active service simulation.

How to eliminate wrong answers

Option A is wrong because Wireshark is a packet capture and analysis tool; it can observe DNS queries but cannot simulate DNS responses or redirect traffic. Option B is wrong because Netcat is a general-purpose networking utility for reading and writing data across TCP/UDP connections, but it does not provide DNS server simulation. Option C is wrong because Nmap is a port scanner and network discovery tool, not a DNS server simulator.

Practice this question →
26
MCQeasy

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should the analyst take?

A.Submit the binary to a public multi-engine scanning service and read the detection names
B.Run the binary in a sandbox and record the hash from the sandbox report
C.Open the binary in a hex editor and visually inspect the first bytes
D.Use a utility such as certutil -hashfile or sha256sum to compute the file's hash
AnswerD

certutil -hashfile on Windows and sha256sum on Linux compute cryptographic hashes of a file without executing it. These are built-in, fast, and reliable for generating values that can be compared to threat intelligence. This satisfies the pre-execution, no-detection-risk requirement of the scenario directly.

Why this answer

The analyst needs a cryptographic hash without executing the sample. Built-in utilities such as certutil -hashfile on Windows or sha256sum on Linux generate MD5, SHA-1, or SHA-256 values safely and quickly, enabling comparison against threat intelligence. Sandbox execution, hex inspection, and public submissions either execute the file, fail to produce a hash, or expose the sample unnecessarily.

Exam trap

The trap here is believing a sandbox or scanning service is needed to obtain a hash, when a local hashing utility produces the value instantly without any execution risk.

Practice this question →
27
Multi-Selecthard

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Select 3 answers
A.Windows Scheduled Tasks
B.System memory dumps
C.Registry 'Run' keys
D.Startup folders
E.Event log files
AnswersA, C, D

Scheduled Tasks survive reboots and run without user interaction, so attackers register a malicious task to relaunch their payload automatically. Checking the task library, its triggers and actions exposes this persistence mechanism, satisfying the stem's requirement for a commonly examined persistence artifact.

Why this answer

Windows Scheduled Tasks (A) are a classic persistence mechanism because an attacker can create a task that re-executes malware at logon, on a schedule, or at system startup, so analysts routinely enumerate them (e.g., schtasks /query or the Task Scheduler library) for suspicious entries. Registry 'Run' keys (C), such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the HKLM equivalent, are checked because they cause programs to launch automatically at user logon or system boot, making them a favorite autostart location for implants. Startup folders (D), both the per-user and all-users Startup directories, are also examined since any shortcut or executable placed there executes automatically when the user logs in.

System memory dumps (B) are useful for live forensics such as extracting credentials or injected code, but they are not a standard persistence artifact, and Event log files (E) are examined for evidence of activity or tampering rather than being a persistence location themselves.

Exam trap

312-39 often tests whether candidates confuse persistence artifacts (where malware installs itself) with forensic evidence sources (memory dumps, event logs) that merely help you find persistence.

Practice this question →
28
MCQhard

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

A.Process Hacker
B.Wireshark
C.Detect It Easy (DIE)
D.HashCalc
AnswerC

Detect It Easy inspects PE headers, section entropy and packer signatures to flag likely packing or obfuscation. High entropy and unusual section names are the indicators it surfaces, directly answering whether the suspicious file is packed.

Why this answer

Detect It Easy (DIE) is a packer/compiler detection tool that analyzes PE headers, section entropy, and signatures to identify whether a file is packed and with which packer. High entropy in sections like UPX0 or unusual section names are classic packing indicators.

Exam trap

EC-Council 312-39 often tests tool-to-task mapping — candidates pick Process Hacker or Wireshark because they are familiar, missing that packing detection is a static file-analysis task best served by DIE.

How to eliminate wrong answers

Option A is wrong because Process Hacker is a live system monitoring tool for processes, handles, and memory — it does not statically identify packing. Option B is wrong because Wireshark captures and analyzes network traffic, not file structure. Option D is wrong because HashCalc computes file hashes for integrity or identification, not packing detection.

Practice this question →
29
MCQmedium

A SOC analyst is investigating a suspected compromised Windows 10 workstation. The analyst wants to determine which removable USB storage devices were connected to the host and correlate that activity with a suspicious data exfiltration alert. Which artifact or registry location should the analyst examine FIRST to enumerate historically connected USB mass storage devices?

A.The NTUSER.DAT hive, under Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
B.The SYSTEM hive, under ControlSet00X\Enum\USBSTOR
C.The SECURITY hive, under Policy\Secrets
D.The SAM hive, under SAM\Domains\Account\Users
AnswerB

The USBSTOR key in the SYSTEM hive records the device instance for every USB mass storage device that has ever been attached, including vendor and product identifiers. It persists after the device is disconnected, which is exactly what is needed to retrospectively confirm which removable drives touched this workstation and to pivot toward volume serial numbers in the setupapi logs.

Why this answer

USBSTOR under the SYSTEM hive is the canonical persistent record of USB mass storage devices attached to a Windows system, storing device instance IDs with vendor, product, and revision strings. It survives device removal and reboots, allowing retrospective enumeration. MountPoints2 supplements this per-user, while Policy\Secrets and SAM hold credential and account data unrelated to device history.

Exam trap

The trap here is assuming that MountPoints2 enumerates all USB devices, when it only reflects volumes mounted by a specific user profile and omits devices never assigned a drive letter.

Practice this question →
30
MCQhard

A SOC analyst is performing live forensic triage on a Windows Server 2019 host suspected of a credential-dumping attack. The analyst wants to identify whether the LSASS process memory has been accessed by an unauthorized tool in the last 24 hours. Which Windows event log source and event ID should the analyst review?

A.Security log, event ID 4624
B.System log, event ID 7045
C.Security log, event ID 4688
D.Sysmon operational log, event ID 10
AnswerD

Sysmon event ID 10 is ProcessAccess and logs when a process opens a handle to another process, including the source image, target image, granted access, and call trace. When configured to monitor LSASS, it can reveal unauthorized tools such as Mimikatz or comsvcs.dll MiniDump accessing lsass.exe. This directly answers whether LSASS memory was accessed in the last 24 hours.

Why this answer

Sysmon event ID 10 (ProcessAccess) captures handle opens to other processes, including the source image, target image, and granted access rights. When Sysmon is configured with a rule for lsass.exe, it provides direct evidence of credential-dumping tools accessing LSASS. Security 4688 and 4624 and System 7045 do not record process-to-process handle operations, so they cannot answer the specific question.

Exam trap

The trap here is confusing process creation logging with process access logging; event ID 4688 shows a tool starting, but only Sysmon event ID 10 shows it opening a handle to LSASS.

Practice this question →
31
MCQeasy

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

A.The file size is less than 100 KB.
B.The file has a large number of imported functions from kernel32.dll.
C.The file has a high entropy value, especially in the code sections.
D.The file contains a digital signature from a known vendor.
AnswerC

Packed files typically have high entropy because compression or encryption is used to obscure the original code. Tools like PEiD or Detect It Easy can calculate entropy; values above 7.0 often indicate packing. This is a reliable indicator because legitimate code usually has lower entropy due to structured instructions and data.

Why this answer

High entropy in code sections is a strong indicator of packing because packers compress or encrypt the original executable, resulting in randomized data. Tools like PEiD or Detect It Easy can identify known packers, but entropy analysis is a fundamental first step. In contrast, other options like digital signatures or import counts do not directly correlate with packing and may even suggest the opposite.

Exam trap

The trap here is assuming that file size or import count indicates packing, but packers often minimize imports and can produce various file sizes, making entropy the most reliable indicator.

Practice this question →
32
MCQmedium

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

A.netstat -ano
B.nslookup
C.arp -a
D.tracert
AnswerA

netstat -ano lists active connections with the owning process identifier in the final column, so the analyst can filter the output for PID 4212 and immediately map each connection to that process. The -a switch shows all connections and listening ports, -n keeps addresses numeric for speed, and -o appends the PID, making it the correct built-in choice for this live triage task.

Why this answer

The analyst needs a live mapping of connections to the owning process on a Windows host using only built-in tooling. The netstat utility with the -a, -n, and -o switches enumerates all connections in numeric form and appends the owning PID, allowing direct correlation to PID 4212. None of the other utilities expose socket ownership, so they cannot answer the question.

Exam trap

The trap here is assuming any network utility will reveal process ownership, when only netstat's -o switch (or equivalent Get-NetTCPConnection with OwningProcess) ties a connection to a PID.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Forensic Investigation And Malware Analysis questions.

Start 20-question session