A forensic investigator has collected a hard drive from a suspect and created a forensic image. The investigator then analyzed the image and found evidence of illegal activity. The defense attorney challenges the admissibility of the evidence, claiming the chain of custody was broken. Which piece of information would most effectively refute this claim?

A photograph of the hard drive at the time of collection.

A statement from the investigator that the evidence was handled properly.

A detailed log showing every person who handled the evidence, with dates, times, and purposes.

A hash value of the forensic image that matches the original drive.

A security team is analyzing a breach where the attacker used a spear-phishing email to deliver a malicious macro, then used PowerShell to download additional tools, and finally exfiltrated data over HTTPS. The team wants to map these actions to the MITRE ATT&CK framework to identify gaps in detection. Which approach best aligns with this goal?

Classify the actions as TTPs and assign a severity score.

Identify the tactics and techniques for each observed action and map them to ATT&CK.

Search for the attacker's IP address in threat intelligence feeds.

Use the Cyber Kill Chain to label each action as a phase.

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 5Objective 2

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 2)

Part of the Incident Handling domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 6–10

6expert · hard
A forensic investigator has collected a hard drive from a suspect and created a forensic image. The investigator then analyzed the image and found evidence of illegal activity. The defense attorney challenges the admissibility of the evidence, claiming the chain of custody was broken. Which piece of information would most effectively refute this claim?
Select an answer first
7foundation · easy
Which of the following is an example of a MITRE ATT&CK technique?
Select an answer first
8application · medium
A security team is analyzing a breach where the attacker used a spear-phishing email to deliver a malicious macro, then used PowerShell to download additional tools, and finally exfiltrated data over HTTPS. The team wants to map these actions to the MITRE ATT&CK framework to identify gaps in detection. Which approach best aligns with this goal?
Select an answer first
9foundation · easy
Which of the following is a common digital artifact that can serve as a source of evidence in a forensic investigation?
Select an answer first
10application · medium
A security team is analyzing an intrusion where the attacker used a spear-phishing email to deliver a malicious attachment that created a backdoor. The team wants to map the attack to the MITRE ATT&CK framework. Which tactic would the backdoor creation be classified under?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 2)

Questions 6–10

Which of the following is an example of a MITRE ATT&CK technique?

Which of the following is a common digital artifact that can serve as a source of evidence in a forensic investigation?

A security team is analyzing an intrusion where the attacker used a spear-phishing email to deliver a malicious attachment that created a backdoor. The team wants to map the attack to the MITRE ATT&CK framework. Which tactic would the backdoor creation be classified under?

Keep studying — Incident Handling