Cybercrime Investigation Quiz

What does the term "phishing" refer to in the context of cybercrime?

• A method of encrypting sensitive data

• A fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity

• A technique used to speed up network connections

• A process of backing up digital evidence

Which of the following is a commonly used digital forensics tool for analyzing disk images?

• Wireshark

• Metasploit

• Autopsy

• Nmap

What is the primary purpose of threat intelligence sharing between organizations?

• To increase the cost of cybersecurity operations

• To collaboratively improve defenses by exchanging information about threats and vulnerabilities

• To replace the need for internal security teams

• To publicly expose cybercriminals without legal action

Which type of malware is specifically designed to encrypt a victim's files and demand payment for decryption?

• Spyware

• Adware

• Ransomware

• Rootkit

What does the acronym "IOC" stand for in the context of cybercrime investigation?

• Internet Operations Center

• Indicator of Compromise

• Internal Oversight Committee

• Integrated Output Control

A cybersecurity analyst notices unusual outbound traffic from a workstation at odd hours. Which incident response step should the analyst perform first?

• Immediately shut down the entire network

• Identify and contain the affected system to prevent further spread

• Notify the media about the potential breach

• Delete all logs to prevent data leakage

During a phishing investigation, an analyst identifies that emails contain a spoofed sender domain. Which technique would best help verify the authenticity of the email's origin?

• Checking the email's font style

• Analyzing the email's SPF, DKIM, and DMARC records

• Counting the number of recipients in the email

• Reviewing the email's subject line length

A forensic investigator is analyzing a suspect's hard drive. Which of the following best describes why creating a bit-for-bit copy (forensic image) of the drive is important before analysis?

• It makes the analysis process faster

• It ensures the original evidence remains unaltered and maintains integrity

• It allows the investigator to delete unnecessary files

• It compresses the data to save storage space

When performing static malware analysis, which of the following actions would an analyst typically carry out?

• Running the malware in a controlled sandbox environment

• Examining the malware's code, strings, and metadata without executing it

• Monitoring the malware's network connections in real time

• Allowing the malware to infect a live system to observe behavior

A security team receives threat intelligence indicating that a known threat actor uses spear-phishing emails with malicious PDF attachments. Which combination of controls would most effectively mitigate this specific threat?

• Disabling all email services and switching to phone communication

• Implementing email filtering, user awareness training, and PDF sandboxing

• Increasing network bandwidth and upgrading hardware

• Blocking all outbound traffic from the organization