Question bank
Registered Intrusion Analyst
43 Registered Intrusion Analyst questions with the correct answer and a written explanation, organised across 5 exam domains.
- 43 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Forensic Analysis and Investigation
11 questions in this domain
- Question 1Single Choice
According to RFC 3227, which type of evidence must be collected first during digital forensic acquisition?
- ACPU registers and cacheCorrect answer
- BHard drive contents
- CNetwork packet captures
- DEvent logs
Why this is the answer
The Order of Volatility (OoV) in RFC 3227 states CPU registers and cache are the most volatile and must be captured first.
- Question 2Multiple Select
Which two tools are specifically designed for memory acquisition on Windows systems? (Choose two.)
- AWinPmemCorrect answer
- BMagnet RAM CaptureCorrect answer
- CFTK Imager
- DAutopsy
Why this is the answer
WinPmem and Magnet RAM Capture are memory acquisition tools; FTK Imager is for disk imaging, Autopsy is for analysis.
- Question 3Interactive
Examine the following command used during live response. What does it capture?
- ANetwork connections and process listCorrect answer
- BFull memory dump
- CDisk partition table
- DRegistry hives
Why this is the answer
The command captures network state and running processes, which are volatile data items.
- Question 4Single Choice
What is the minimum cryptographic hash standard recommended for verifying forensic image integrity?
- ASHA-256Correct answer
- BMD5
- CSHA-1
- DCRC32
Why this is the answer
The document specifies SHA-256 as the minimum for cryptographic hashing of forensic images.
- Question 5Multiple Select
Which two items are part of a proper chain of custody for digital evidence? (Choose two.)
- AHash values computed at acquisition and verificationCorrect answer
- BTimestamps of each evidence transferCorrect answer
- CNetwork bandwidth used during capture
- DAntivirus version installed on analysis machine
Why this is the answer
Chain of custody requires hash values and timestamps to prove integrity and handling.
- Question 6Interactive
The following command is used to capture memory on a Linux server. What is the tool being utilized?
- ALiMECorrect answer
- Bdd
- CMemProcFS
- DRekall
Why this is the answer
The command uses LiME (Linux Memory Extractor) to acquire memory with a specified output file.
- Question 7Single Choice
What must be used when acquiring a disk from a suspect drive to prevent any write operations to the source?
- AHardware write-blockerCorrect answer
- BSoftware write-blocker only
- CForensic boot CD
- DNetwork share
Why this is the answer
A hardware write-blocker physically prevents any write commands from reaching the suspect drive.
- Question 8Multiple Select
Which two are common tools for network packet capture during incident response? (Choose two.)
- AtcpdumpCorrect answer
- BWiresharkCorrect answer
- CFTK Imager
- DRegRipper
Why this is the answer
tcpdump and Wireshark are standard tools for capturing and analyzing network packets.
- Question 9Interactive
Review this command used for live response. Which system artifact is being collected?
- ARegistry hive (SAM)Correct answer
- BMemory dump
- CEvent log
- DPrefetch files
Why this is the answer
The 'reg save' command exports a registry hive (SAM) for offline analysis.
- Question 10Single Choice
Which tool is considered the industry standard for creating forensically sound disk images?
- AFTK ImagerCorrect answer
- BVelociraptor
- CVolatility
- DAutopsy
Why this is the answer
FTK Imager is the industry standard for creating forensically sound disk images in E01 or raw format.
- Question 11Multiple Select
Which two are examples of non-volatile data that persists across reboots? (Choose two.)
- ARegistry hivesCorrect answer
- BPrefetch filesCorrect answer
- CNetwork connections
- DProcess list
Why this is the answer
Registry hives and prefetch files are stored on disk and survive reboots, unlike volatile memory data.
Incident Response
11 questions in this domain
- Question 12Single Choice
What is the first phase in the SANS PICERL incident response model?
- APreparationCorrect answer
- BIdentification
- CContainment
- DLessons Learned
Why this is the answer
Preparation is the foundational phase that includes planning, tool acquisition, and training before any incident occurs.
- Question 13Multiple Select
Which phases are explicitly separated in the SANS PICERL model but combined into a single phase in NIST SP 800-61?
- AContainmentCorrect answer
- BEradicationCorrect answer
- CRecoveryCorrect answer
- DPreparation
Why this is the answer
NIST SP 800-61 combines Containment, Eradication, and Recovery into a single phase, whereas SANS PICERL treats them as three separate phases.
- Question 14Interactive
Consider the following action: 'Disconnecting a compromised host from the network.' According to SANS PICERL, which phase does this belong to?
- AIdentification
- BContainmentCorrect answer
- CEradication
- DRecovery
Why this is the answer
Disconnecting a host is a short-term containment action to prevent the incident from spreading.
- Question 15Single Choice
What is the primary purpose of the identification phase in incident response?
- ARecognizing that an incident may be occurringCorrect answer
- BRemoving the root cause of the incident
- CRestoring systems to normal operation
- DDocumenting lessons learned
Why this is the answer
Identification is about detecting and confirming incidents through alerts, logs, or user reports.
- Question 16Multiple Select
Which of the following are key activities performed during the preparation phase of incident response?
- ACreating an incident response planCorrect answer
- BAcquiring forensic imaging kitsCorrect answer
- CEstablishing communication channelsCorrect answer
- DAnalyzing memory dumps
Why this is the answer
Preparation includes planning, tool acquisition, and training; analyzing memory dumps is part of identification or analysis, not preparation.
- Question 17Interactive
A security team receives an alert about a potential data exfiltration from a web server. According to triage best practices, what should the analyst do first?
- AIsolate the web server from the network
- BReview the raw logs to verify the alertCorrect answer
- CReport the incident to the regulatory authority
- DRebuild the server from a clean backup
Why this is the answer
Initial verification of the alert through log review is the correct first triage step before any containment or reporting.
- Question 18Single Choice
In incident triage, what does the term 'severity' refer to?
- AThe business-driven ordering of incidents
- BThe intrinsic danger of the alert based on CIA impactCorrect answer
- CThe number of affected systems
- DThe time since the alert was generated
Why this is the answer
Severity is determined by the technical impact on confidentiality, integrity, and availability, while priority includes business factors.
- Question 19Multiple Select
Which factors should be considered when prioritizing security incidents during triage?
- ACriticality of the affected assetCorrect answer
- BKill-chain stage of the attackCorrect answer
- CRegulatory reporting deadlinesCorrect answer
- DNumber of false positives from the same rule
Why this is the answer
Priority is adjusted using asset value, attack phase, and legal obligations; past false positives do not automatically lower priority.
- Question 20Interactive
An analyst sees three simultaneous alerts: a brute force on a VPN, a phishing report from HR, and an antivirus detection on a domain controller. Which should be handled first?
- AAntivirus detection on a domain controllerCorrect answer
- BBrute force on the VPN gateway
- CPhishing report from HR
- DAll should be handled simultaneously
Why this is the answer
A confirmed compromise on a critical asset (domain controller) takes highest priority due to potential impact on authentication and data.
- Question 21Single Choice
What is the primary goal of the containment phase in incident response?
- AStopping the incident from spreadingCorrect answer
- BRemoving malware from affected systems
- CRestoring data from backups
- DDocumenting the attack timeline
Why this is the answer
Containment is about immediate actions to limit damage and prevent lateral movement. Eradication and recovery come later.
- Question 22Multiple Select
Which actions are considered part of the eradication phase?
- ARemoving persistence mechanismsCorrect answer
- BResetting compromised credentialsCorrect answer
- CScanning all systems with IoC listsCorrect answer
- DRestoring the system from backup
Why this is the answer
Eradication involves removing all traces of the adversary; restoration from backup is part of recovery.
Malware Analysis
9 questions in this domain
- Question 23Single Choice
What is the primary purpose of generating a SHA-256 hash of a malware sample during static analysis?
- ATo uniquely identify the sampleCorrect answer
- BTo determine the file type
- CTo extract embedded strings
- DTo detect packers
Why this is the answer
A SHA-256 hash provides a unique identifier for the file, allowing correlation with threat intelligence feeds. The other options are done with different tools.
- Question 24Multiple Select
Which two of the following are common static analysis techniques for malware? (Select two)
- AExamining PE headersCorrect answer
- BRunning the sample in a VM
- CExtracting strings with 'strings'Correct answer
- DMonitoring registry changes
Why this is the answer
PE header examination and string extraction are static; running in VM is dynamic, and monitoring registry is dynamic analysis.
- Question 25Interactive
Examine the code block showing a PE section header. Which section characteristic indicates the code is executable?
- AIMAGE_SCN_MEM_EXECUTECorrect answer
- BIMAGE_SCN_MEM_READ
- CIMAGE_SCN_MEM_WRITE
- DIMAGE_SCN_CNT_CODE
Why this is the answer
IMAGE_SCN_MEM_EXECUTE is the characteristic that allows the section to be executed. The other flags control read/write permissions.
- Question 26Single Choice
What does high entropy (close to 8.0) in the .text section of a PE file typically indicate?
- AThe code is packed or encryptedCorrect answer
- BThe file is a legitimate Windows binary
- CThe section contains only ASCII strings
- DThe file has no imports
Why this is the answer
High entropy in a code section often indicates packing or encryption because compressed/encrypted data has high randomness. Normal code has lower entropy.
- Question 27Multiple Select
Which two of the following are examples of persistence mechanisms used by malware? (Select two)
- ARegistry Run keysCorrect answer
- BProcess hollowing
- CScheduled tasksCorrect answer
- DAPI hooking
Why this is the answer
Registry Run keys and scheduled tasks ensure the malware runs automatically after reboot. Process hollowing and API hooking are runtime evasion techniques.
- Question 28Interactive
Review the strings output from a malware sample. Which extracted string is most likely a C2 indicator?
- Ahttp://malicious.com/botCorrect answer
- BC:\\Windows\\System32\\kernel32.dll
- CMicrosoft Windows 10
- DError: File not found
Why this is the answer
The URL with a suspicious domain and path is a typical C2 indicator. The other strings are benign system references or error messages.
- Question 29Single Choice
What is the main risk of relying solely on a sandbox's automated verdict without manual verification?
- AThe malware may detect the sandbox and not execute its payloadCorrect answer
- BSandboxes always produce false positives
- CSandboxes cannot capture network traffic
- DThe verdict is usually accurate
Why this is the answer
Many malware samples employ anti-sandbox techniques that cause them to behave innocuously, leading to false negatives if the analyst accepts the verdict blindly.
- Question 30Multiple Select
Which two of the following are indicators that a malware sample may be packed? (Select two)
- ASmall import tableCorrect answer
- BLow entropy in all sections
- CSections named .UPX0 and .UPX1Correct answer
- DHigh number of exported functions
Why this is the answer
Packed files often have a minimal import table (because the true imports are resolved at runtime) and section names like .UPX0. Low entropy would indicate uncompressed code.
- Question 31Interactive
Analyze the registry key path: HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MalwareService. What does this indicate?
- AIt uses a Run key for user-level persistenceCorrect answer
- BIt installs a system service
- CIt modifies browser settings
- DIt creates a scheduled task
Why this is the answer
The Run key under HKCU causes the specified program to run every time the user logs on, providing user-level persistence.
Network Security Monitoring
6 questions in this domain
- Question 32Single Choice
What field is typically recorded in a firewall log to indicate the outcome of a connection attempt?
- AActionCorrect answer
- BUser-Agent
- CURL
- DPayload
Why this is the answer
The action field (allow/deny) indicates the firewall decision on a connection.
- Question 33Multiple Select
Which of the following fields are typically found in an IDS/IPS log? (Select two)
- ARule IDCorrect answer
- BAlert severityCorrect answer
- CHTTP status code
- DUser-Agent string
Why this is the answer
IDS/IPS logs include rule ID and severity; HTTP status and User-Agent are from proxy logs.
- Question 34Interactive
Examine the log entry below. What type of network device generated this log?
- AFirewall
- BIDS/IPS
- CProxyCorrect answer
- DRouter
Why this is the answer
The log includes client IP, URL, HTTP method, and status code, typical of a proxy log.
- Question 35Single Choice
What is the primary function of a Security Information and Event Management (SIEM) system?
- AAggregate and correlate log data from multiple sourcesCorrect answer
- BBlock malicious traffic in real-time
- CReplace the need for firewall logs
- DEncrypt all network communications
Why this is the answer
A SIEM aggregates, normalises, and correlates log data to produce security alerts.
- Question 36Multiple Select
Which of the following are standard severity levels assigned to SIEM alerts? (Select two)
- AHighCorrect answer
- BMediumCorrect answer
- CConfirmed
- DEscalated
Why this is the answer
SIEMs use levels like Informational, Low, Medium, High, Critical; High and Medium are standard.
- Question 37Interactive
The following correlation rule is used in a SIEM. What type of detection does it represent?
- ASignature-based detection
- BAnomaly-based detection
- CThreshold-based detectionCorrect answer
- DBehavioural detection
Why this is the answer
The rule triggers when failed logins exceed a threshold in a time window, typical of threshold-based detection.
SOC Processes and Operations
6 questions in this domain
- Question 38Single Choice
What is the primary role of a Tier 1 analyst in a SOC?
- APerforming deep forensic analysis
- BTriage and initial response to alertsCorrect answer
- CReverse engineering malware samples
- DDeveloping custom detection rules
Why this is the answer
Tier 1 analysts triage alerts, filter false positives, and escalate confirmed incidents. Deep forensics and reverse engineering are Tier 2/3 roles.
- Question 39Multiple Select
Which of the following are valid escalation triggers from Tier 1 to Tier 2? (Select all that apply)
- AConfirmed true positive after triageCorrect answer
- BAlert that can be resolved by a runbook
- CIncident with moderate/high business impactCorrect answer
- DAny alert that appears unusual even if unverified
Why this is the answer
Escalation is for confirmed incidents beyond runbook resolution or with significant impact. Alerts resolvable by runbook stay at Tier 1; unverified alerts need more analysis.
- Question 40Interactive
Review the SIEM query output below. Which Cyber Kill Chain phase is most directly associated with the detected event?
- AReconnaissance
- BDelivery
- CCommand & ControlCorrect answer
- DActions on Objectives
Why this is the answer
A DNS query to a known malicious domain indicates the adversary is maintaining communication with a C2 server, which is the Command & Control phase.
- Question 41Single Choice
Which Cyber Kill Chain phase involves the attacker delivering the weaponized payload to the target?
- AWeaponization
- BDeliveryCorrect answer
- CExploitation
- DInstallation
Why this is the answer
Delivery is the phase where the weapon (e.g., phishing email, USB drop) is sent to the target. Weaponization precedes it; Exploitation triggers the payload; Installation follows.
- Question 42Multiple Select
Which of the following are valid Cyber Kill Chain phases? (Select all that apply)
- AReconnaissanceCorrect answer
- BWeaponizationCorrect answer
- CDeliveryCorrect answer
- DExploitationCorrect answer
Why this is the answer
All four listed are actual phases. The complete chain is Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives.
- Question 43Interactive
Examine the event sequence. Which MITRE ATT&CK technique is most likely being used?
- AT1053.005 (Scheduled Task/Job)
- BT1059.001 (PowerShell)Correct answer
- CT1078 (Valid Accounts)
- DT1547.001 (Boot or Logon Autostart Execution: Registry Run Keys)
Why this is the answer
The event shows a PowerShell script invoked with encoded command. This aligns with T1059.001 Command and Scripting Interpreter: PowerShell.
Frequently asked questions
Everything about the Registered Intrusion Analyst question bank and how to use it.