Exam CAS-005 topic 1 question 56 discussion

Actual exam question from CompTIA's CAS-005

Question #: 56
Topic #: 1

An analyst is working to address a potential compromise of a corporate endpoint and discovers the attacker accessed a user's credentials. However, it is unclear if the system baseline was modified to achieve persistence. Which of the following would most likely support forensic activities in this scenario?

A. Side-channel analysis
B. Bit-level disk duplication
C. Software composition analysis
D. SCAP scanner

Show Suggested Answer

Suggested Answer: B 🗳️

by mj2x at July 14, 2025, 9:48 p.m.

Comments

Submit Cancel

mj2x

1 day, 5 hours ago

Selected Answer: B

B. Bit-level disk duplication ✅ Why Bit-level disk duplication is the best choice: It creates an exact forensic copy of the entire disk, including deleted files, hidden partitions, and low-level artifacts that are not visible at the file system level. This allows analysts to investigate whether the system baseline was modified, such as if: Persistence mechanisms (e.g., malicious startup entries, scheduled tasks, DLL injections) were installed Rootkits or bootkits were used Hidden or unauthorized files were placed on the system It’s a standard practice in digital forensics to preserve the state of the system without altering original evidence.

upvoted 1 times

...