Cybersec First Responder Free Sample Questions

This statement is false. A physical acquisition, which creates a bit-for-bit copy of the entire flash memory, is forensically superior because it captures all data, including deleted files, file fragments, and unallocated space. A logical acquisition only captures the file system view, similar to a user backup, and misses this crucial deleted or hidden data. While a logical acquisition can be faster, a physical acquisition is preferred for a complete forensic investigation.

Prefetch files (.pf) are specifically created by Windows to speed up application loading. Forensically, they are invaluable as they contain the executable name, a hash of its path, a run count, and the timestamp of the last execution. This makes them the most direct and detailed artifact for proving a specific program was run. LNK files indicate a file was accessed, but not necessarily executed. The Security Event Log requires process creation auditing to be enabled, which is often not on by default. Shellbags track folder browsing, not program execution.

The Chain of Custody form is a legal document that provides a detailed chronological record of every person who handled a piece of evidence, the dates and times it was handled, and the purpose for the handling. This meticulous record-keeping is essential to prove that the evidence has not been tampered with or altered, ensuring its admissibility and integrity in legal proceedings.

The Volatility Framework is an open-source memory forensics tool specifically designed to analyze RAM dumps. For fileless or in-memory malware, the primary evidence (such as running processes, injected code, and network connections) exists only in volatile memory. Volatility allows an investigator to extract these artifacts from a memory image, which is essential when disk-based evidence is minimal or nonexistent. FTK Imager and Autopsy are primarily for disk forensics, and Wireshark is for network traffic analysis.

A write-blocker is a device or software that prevents any write operations to a storage device. This is absolutely critical in digital forensics to ensure that the process of connecting and imaging the source drive does not alter it in any way (e.g., by updating timestamps or writing temporary files). Using a write-blocker is a fundamental step in creating a forensically sound duplicate.

While enforcing credential rotation is a good practice, the root cause was storing credentials in plaintext. A secrets management vault (like HashiCorp Vault or AWS Secrets Manager) is the most effective countermeasure as it eliminates plaintext credentials, provides secure storage, manages access control, and often includes features for automated rotation, addressing the root cause more comprehensively.

On RPM-based systems (like CentOS, RHEL, Fedora), the rpm -V command verifies the integrity of files belonging to a package against the RPM database. This check includes size, MD5 sum, permissions, and other metadata. Since /bin/ls is part of the coreutils package, this command is the correct way to detect modifications. The stat and ls commands can be trojanized by the attacker, making them unreliable.

ICS and SCADA environments are extremely sensitive to active network probes, which can cause PLCs and other devices to fail or behave unpredictably, leading to operational downtime or safety risks. A passive scanning approach, which analyzes network traffic without sending any packets to the devices, is the most appropriate method. This allows the analyst to identify assets, protocols, and potential vulnerabilities without risking disruption.

A tiered access model (Tier 0 for domain controllers, Tier 1 for servers, Tier 2 for workstations) prevents high-privilege credentials from being exposed on lower-trust systems, effectively containing the impact of a compromise.

PAWs are hardened, dedicated machines used only for sensitive administrative tasks. This practice isolates administrative credentials from the higher-risk environment of daily-use workstations (email, web browsing), significantly reducing the attack surface.

False. While a VM snapshot captures the state of the disk and optionally the memory, the process of creating the snapshot can alter the state of the live system, modifying file timestamps and memory contents. It is not a bit-for-bit copy and does not typically come with the cryptographic hashing and chain-of-custody documentation required for it to be considered a 'forensically sound' duplicate in a legal context. Dedicated forensic imaging tools should be used instead.