Courseiva

312-39 · topic practice

Forensic Investigation And Malware Analysis practice questions

This domain covers incident response forensics and malware analysis for SOC analysts: capturing and examining malicious binaries, memory forensics on compromised Windows hosts, and identifying persistence and injection artifacts. Questions are scenario-based, asking you to select the correct tool, artifact, or first action, and include multiple-response items requiring two or three correct selections.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member
20 questionsDomain: Forensic Investigation And Malware Analysis
Practice 10 questionsBrowse domain →

What the exam tests

What to know about Forensic Investigation And Malware Analysis

Be able to pick the right forensic or malware analysis tool for a scenario, hash a sample before execution, and identify process injection and persistence artifacts in memory and on disk. The most important thing is reading whether the question wants a tool, an artifact, or a first action, and matching the exact count of answers requested.

Using INetSim to simulate DNS and other network services during dynamic malware analysis

Computing cryptographic hashes with tools like md5sum or sha256sum before executing a suspicious binary

Identifying process injection artifacts in memory dumps, such as injected code in non-image memory and unexpected remote threads

Checking common persistence locations including Run registry keys, scheduled tasks, and services

Watch out for

Common Forensic Investigation And Malware Analysis exam traps

  • ▸Choosing a packet capture or proxy tool when the scenario asks for DNS response simulation, which INetSim specifically provides
  • ▸Executing the binary or submitting it to a sandbox before hashing, when the question requires a hash first
  • ▸Listing generic memory artifacts instead of the specific injection indicators the question demands, or selecting more than the required number of answers

Practice set

Forensic Investigation And Malware Analysis questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst is analyzing a suspicious email attachment. The analyst wants to extract URLs and embedded files without detonating the payload in a full sandbox. Which tool is recommended for this type of file parsing?

Question 2easymultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst needs to capture volatile memory for a forensic investigation on a suspected compromised Windows workstation. Which command-line tool, when executed with the appropriate privilege level, allows for the acquisition of a physical RAM image?

Question 3mediummultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

You are investigating a file-less malware infection. Where in the Windows Registry would you look to identify common persistence mechanisms used by malicious scripts?

Question 4mediummultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst is investigating a compromised Windows 10 endpoint. The attacker used a novel dropper that does not write a persistent executable to disk; instead, it injects a reflective DLL into a legitimate process and then deletes its original payload. The analyst has a full memory capture from the endpoint. Which Volatility 3 plugin should the analyst use first to enumerate hidden or unlinked processes that may host the injected code?

Question 5easymultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

Question 6hardmultiple choice
Read the full DNS explanation →

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

Question 7mediummultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

Question 8mediummultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

Question 9hardmultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

Question 10hardmultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

Question 11hardmultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

Question 12mediummulti select
Read the full Forensic Investigation And Malware Analysis explanation →

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

Question 13mediummulti select
Read the full Forensic Investigation And Malware Analysis explanation →

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Question 14easymulti select
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

Question 15hardmulti select
Read the full Forensic Investigation And Malware Analysis explanation →

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

Question 16easymultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

Question 17hardmulti select
Read the full Forensic Investigation And Malware Analysis explanation →

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

Question 18mediummultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst receives an alert about a suspicious process named 'svchost.exe' running from C:\Users\Public\Downloads. The analyst wants to quickly determine whether the process is malicious by examining its parent process, command line, and loaded modules. Which Sysinternals tool should the analyst use?

Question 19easymultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

Question 20mediummultiple choice
Read the full Forensic Investigation And Malware Analysis explanation →

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Sign up freeLog in

Focused Forensic Investigation And Malware Analysis sessions

Start a Forensic Investigation And Malware Analysis only practice session

Every question in these sessions is drawn from the Forensic Investigation And Malware Analysis domain — nothing else.

10 questions20 questions30 questions50 questions
Browse all Forensic Investigation And Malware Analysis questions →Mixed 312-39 session

Related practice questions

Related 312-39 topic practice pages

Move into related areas when this topic feels solid.

Incident Response practice questions

Practise 312-39 questions linked to Incident Response.

SOC For Cloud Environments practice questions

SOC For Cloud Environments practice questions for 312-39.

Cyber Threats Iocs And Attack Methodology practice questions

Targeted 312-39 practice covering Cyber Threats Iocs And Attack Methodology.

Forensic Investigation And Malware Analysis practice questions

Work through 312-39 questions on Forensic Investigation And Malware Analysis.

Incident Detection And Triage practice questions

Targeted 312-39 practice covering Incident Detection And Triage.

Log Management practice questions

Work through 312-39 questions on Log Management.

Proactive Threat Detection practice questions

Work through 312-39 questions on Proactive Threat Detection.

Security Operations And Management practice questions

Practise 312-39 questions linked to Security Operations And Management.

312-39 fundamentals practice questions

Sharpen your 312-39 knowledge of 312-39 fundamentals.

312-39 scenario practice questions

Sharpen your 312-39 knowledge of 312-39 scenario.

312-39 troubleshooting practice questions

Sharpen your 312-39 knowledge of 312-39 troubleshooting.

Frequently asked questions

What does the 312-39 exam test about Forensic Investigation And Malware Analysis?
Be able to pick the right forensic or malware analysis tool for a scenario, hash a sample before execution, and identify process injection and persistence artifacts in memory and on disk. The most important thing is reading whether the question wants a tool, an artifact, or a first action, and matching the exact count of answers requested.
How should I use these practice questions?
Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Forensic Investigation And Malware Analysis questions in a focused session?
Yes — the session launcher on this page draws every question from the Forensic Investigation And Malware Analysis domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 312-39 topics?
Use the topic links above to move to related areas, or go back to the 312-39 question bank to see all topics.
Are these real exam questions or dumps?
These are original practice questions written to test the same concepts the 312-39 exam covers. They are not copied from any real exam or dump site.
Certified SOC Analyst (312-39) Forensic Investigation And…