CySA+ Memory Forensics and Disk Imaging Basics

1. What does 'chain of custody' ensure in forensic investigations?

Fast disk access

Evidence integrity and accountability for handling

Automatic malware removal

Network encryption

2. Which statement about forensic image verification is correct?

Hash verification is optional

Hashes must match to confirm image integrity

Only MD5 is acceptable for verification

Verification happens after analysis only

3. In incident response, capturing______ helps identify lateral movement and attacker behavior.

Email archives

System logs and network traffic

Printed documents

Backup tapes only

4. What is the primary advantage of using a hardware write blocker during forensic acquisition?

It speeds up data transfer

It prevents accidental modification of the evidence source

It compresses files automatically

It encrypts the forensic image

5. Memory forensics allows investigators to identify______ that may not be visible on disk.

Encrypted data

Running malware and injected code

Deleted files

Network addresses

6. Which of the following should NOT be done to evidence during collection?

Document the collection process

Modify or alter the original evidence

Hash the evidence for verification

Store in a controlled environment

7. What is a 'forensic soundness' requirement?

Using the loudest tools available

Ensuring evidence is collected without alteration

Recording audio during investigation

Deleting unnecessary files

8. When should you capture network traffic during incident response?

Only after the incident is resolved

As early as possible to preserve evidence

Never, it slows investigation

Only on weekends

9. Which memory analysis tool is used to identify malicious processes and rootkits?

WinRAR

Volatility Framework

Microsoft Excel

Adobe Reader

10. In forensic imaging, what does the 'E01' format provide beyond raw DD format?

Smaller file size only

Compression, metadata, and built-in hash verification

Faster disk performance

Automatic malware scanning

11. Which type of data is lost when a computer is powered off?

Volatile data

Persistent data

Archived data

Cached data

12. Which tool is commonly used for memory acquisition on Windows systems?

Dd

Volatility or DumpIt

Photoshop

Notepad++

13. When collecting memory from a live system, what risk must you consider?

Loss of volatile data if the system is shut down

No risk exists

Automatic file deletion

Network bandwidth reduction

14. What is the order of volatility in incident response?

Hard disk first, then memory

Memory and running processes first, then disk and logs

Logs first, then memory

Network traffic last, always

15. Which imaging format preserves metadata and sector-level detail for forensic analysis?

ZIP archive

Raw DD or EnCase E01 format

JPEG image

PDF document

16. In memory forensics, what is a 'dump' of RAM used for?

To delete malware

To capture running processes and volatile data

To compress system files

To install security patches

17. Which hash algorithm is most commonly used to verify the integrity of forensic images?

MD5 or SHA-1

ROT13

Base64

ASCII encoding

18. What does a write blocker prevent during forensic acquisition?

Reading data from the device

Unauthorized modifications to evidence

Network connectivity

Compression of forensic images

19. Which of the following is considered volatile memory that must be captured during incident response?

Hard disk contents

RAM and running processes

Archived backup files

System BIOS settings

20. What is the primary purpose of creating a forensic image of a hard disk?

To increase disk performance

To preserve evidence and create a bit-for-bit copy

To delete sensitive files permanently

To repair corrupted sectors

CySA+ Memory Forensics and Disk Imaging Basics Quiz