A forensic analyst is about to image a suspect's hard drive. The analyst wants to ensure that the image is an exact copy and that the original is not modified. Which action is MOST important to take before imaging?

Delete temporary files to save space

Calculate a hash of the original drive

Boot the suspect's operating system

A threat hunter is looking for signs of a specific adversary that is known to use PowerShell scripts for execution and to create scheduled tasks for persistence. The hunter wants to use MITRE ATT&CK to develop hypotheses for detection. Which approach is most aligned with this goal?

Search for techniques associated with the 'Execution' and 'Persistence' tactics.

Search for the specific PowerShell commands used by the adversary.

Search for the adversary's name in the ATT&CK Groups page.

Search for the malware family associated with the adversary.

CiscoCertified Support Technician (CCST) Cybersecurity

Domain 5Objective 2

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 3)

Part of the Incident Handling domain, which makes up ~18% of our current practice bank. Cisco does not publish an official question count, but from its 50-minute exam (~20–35 total, ~4–6 in this domain), expect 1–2 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 11–15

11application · medium
A forensic investigator is analyzing a compromised Linux server. The investigator needs to identify which user executed a specific command. Which digital artifact would provide the MOST reliable evidence?
Select an answer first
12application · medium
A security analyst is mapping an attack to the MITRE ATT&CK framework. The attacker used a valid user account to log into a system and then escalated privileges. Which tactic does the use of a valid account represent?
Select an answer first
13application · medium
A forensic analyst is about to image a suspect's hard drive. The analyst wants to ensure that the image is an exact copy and that the original is not modified. Which action is MOST important to take before imaging?
Select an answer first
14application · medium
A threat hunter is looking for signs of a specific adversary that is known to use PowerShell scripts for execution and to create scheduled tasks for persistence. The hunter wants to use MITRE ATT&CK to develop hypotheses for detection. Which approach is most aligned with this goal?
Select an answer first
15application · medium
A forensic analyst needs to preserve the contents of a USB drive that may contain evidence. The analyst wants to ensure the original drive is not altered during the imaging process. Which tool or method should the analyst use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 100-160

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “100-160” is a trademark of its owner, used for identification only.

Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 3)

Questions 11–15

A forensic investigator is analyzing a compromised Linux server. The investigator needs to identify which user executed a specific command. Which digital artifact would provide the MOST reliable evidence?

A security analyst is mapping an attack to the MITRE ATT&CK framework. The attacker used a valid user account to log into a system and then escalated privileges. Which tactic does the use of a valid account represent?

A forensic analyst is about to image a suspect's hard drive. The analyst wants to ensure that the image is an exact copy and that the original is not modified. Which action is MOST important to take before imaging?

A threat hunter is looking for signs of a specific adversary that is known to use PowerShell scripts for execution and to create scheduled tasks for persistence. The hunter wants to use MITRE ATT&CK to develop hypotheses for detection. Which approach is most aligned with this goal?

A forensic analyst needs to preserve the contents of a USB drive that may contain evidence. The analyst wants to ensure the original drive is not altered during the imaging process. Which tool or method should the analyst use?

Keep studying — Incident Handling