CySA+ Memory Forensics and Disk Imaging Basics

1. In memory forensics, what information can be extracted from the process list?

Running applications and their memory addresses

Hard disk partition information

Network firewall rules

User login credentials

2. Which incident response phase typically involves memory and disk acquisition?

Preparation

Detection and Analysis

Containment

Recovery

3. During forensic disk imaging, what does verifying hash values ensure?

Image completeness and integrity

Faster acquisition speed

Encryption of sensitive data

Automatic malware detection

4. What is the primary advantage of using hardware write blockers over software solutions?

Lower cost

Works at hardware level, preventing OS interference

Faster data transfer

Compatible with all file systems

5. Which memory location contains the most critical volatile data for incident investigation?

RAM

ROM

Cache

Swap file

6. In incident response, what does the abbreviation 'ROT' typically refer to?

Recovery of Threats

Restoration of Targets

Remnants of Tools

Repository of Transactions

7. What is the primary role of a forensic examiner during the initial evidence collection phase?

Preserve evidence integrity and document procedures

Prosecute the suspect

Repair damaged systems

Delete suspicious files

8. Which imaging format preserves all file system metadata and is widely accepted in legal proceedings?

DD format

ISO format

RAW format

All of the above

9. What is the primary concern when performing a live acquisition of a running system?

System may shut down unexpectedly

Data can be modified during capture

Network connectivity is required

Disk space limitations

10. Which tool is used to analyze Windows memory dumps for malware and suspicious processes?

Volatility Framework

Burp Suite

Metasploit

Snort

11. What type of data is lost when a computer is powered off without proper forensic preservation?

Volatile data

Non-volatile data

Archived data

Backup data

12. What does a forensic write blocker prevent during disk acquisition?

Data compression

Any writes to the source disk

Network connectivity

Hash calculation

13. Which file system artifact is most useful for recovering deleted files during forensic analysis?

Master Boot Record

File allocation table

Partition table

Boot sector

14. What is the primary advantage of performing memory forensics before shutting down a compromised system?

Preserves volatile evidence like running processes

Reduces the need for disk imaging

Prevents malware propagation

Eliminates the need for logging

15. Which of the following is a live forensic acquisition tool commonly used in incident response?

FTK Imager

Volatility

Wireshark

Nessus

16. In incident response, what is the chain of custody primarily used for?

Documenting evidence handling and accountability

Encrypting sensitive forensic data

Accelerating data recovery processes

Compressing evidence files

17. What does DBAN stand for in the context of data destruction and forensics?

Digital Block Access Network

Darik's Boot and Nuke

Data Backup Archive Node

Disk-Based Access Notation

18. Which hash algorithm is most commonly used to verify disk image integrity in forensic investigations?

MD5

SHA-1

SHA-256

CRC-32

19. What is the primary purpose of creating a forensic image with write-blocking devices?

Prevent modification of original evidence

Increase data transfer speed

Compress storage space

Encrypt sensitive information

20. Which memory acquisition method captures only kernel-level processes and system memory?

Live memory capture

Cold boot acquisition

Hibernation file analysis

Page file extraction

CySA+ Memory Forensics and Disk Imaging Basics Quiz