CFR-410 Cybersec First Responder Practice Questions

This is a direct and effective method. By comparing the destination IPs in the firewall logs with a list of known malicious IPs, the analyst can quickly identify compromised hosts that are communicating with C2 servers, malware distribution sites, or other malicious infrastructure.

Malware often uses domain names for C2 communication. Analyzing DNS logs allows the hunter to find hosts that are trying to resolve malicious domains, even if the subsequent connection is blocked or uses a non-standard protocol. This is a crucial data source for threat hunting.

In a cloud environment, the most volatile evidence (RAM) is often lost if the instance is stopped. The most immediate and critical action is to preserve the state of the storage. Creating a disk snapshot via the provider's API is the standard, non-intrusive first step to preserve the disk evidence. Subsequent actions can then be taken on a clone made from this snapshot, preserving the original evidence.

This strategy is the most effective. Isolating the server (segmentation) immediately stops all outbound exfiltration attempts, regardless of the attacker's use of DGA. By specifically allowing only the necessary inbound application traffic, it minimizes business disruption, meeting a key requirement. This containment method also keeps the system live, preserving volatile evidence (like RAM and running processes) for forensic analysis. This balanced approach addresses containment, business continuity, and evidence preservation simultaneously.

The principle of least privilege dictates that users and processes should be granted only the permissions necessary to perform their assigned tasks. Developers typically do not need persistent, standing administrative access to production environments. This excessive permission creates a significant security risk. Access should be granted on a temporary, as-needed basis (Just-In-Time access).

The core principle of a DMZ is to prevent direct traffic from the Internet to the internal network. In this multi-tier architecture, the Web Server in the DMZ must communicate with the Application Server in the internal network. Therefore, the internal firewall (FW2) must have a specific rule that allows the Web Server to initiate connections to the Application Server, but only on the required application port(s), enforcing the principle of least privilege.

This statement is false. A physical acquisition, which creates a bit-for-bit copy of the entire flash memory, is forensically superior because it captures all data, including deleted files, file fragments, and unallocated space. A logical acquisition only captures the file system view, similar to a user backup, and misses this crucial deleted or hidden data. While a logical acquisition can be faster, a physical acquisition is preferred for a complete forensic investigation.

Prefetch files (.pf) are specifically created by Windows to speed up application loading. Forensically, they are invaluable as they contain the executable name, a hash of its path, a run count, and the timestamp of the last execution. This makes them the most direct and detailed artifact for proving a specific program was run. LNK files indicate a file was accessed, but not necessarily executed. The Security Event Log requires process creation auditing to be enabled, which is often not on by default. Shellbags track folder browsing, not program execution.

The Chain of Custody form is a legal document that provides a detailed chronological record of every person who handled a piece of evidence, the dates and times it was handled, and the purpose for the handling. This meticulous record-keeping is essential to prove that the evidence has not been tampered with or altered, ensuring its admissibility and integrity in legal proceedings.

The Volatility Framework is an open-source memory forensics tool specifically designed to analyze RAM dumps. For fileless or in-memory malware, the primary evidence (such as running processes, injected code, and network connections) exists only in volatile memory. Volatility allows an investigator to extract these artifacts from a memory image, which is essential when disk-based evidence is minimal or nonexistent. FTK Imager and Autopsy are primarily for disk forensics, and Wireshark is for network traffic analysis.

A write-blocker is a device or software that prevents any write operations to a storage device. This is absolutely critical in digital forensics to ensure that the process of connecting and imaging the source drive does not alter it in any way (e.g., by updating timestamps or writing temporary files). Using a write-blocker is a fundamental step in creating a forensically sound duplicate.