Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a best practice to maintain the integrity of digital evidence during an investigation?

   • AComputing a cryptographic hash of the evidence
   • BUsing the original device for analysis
   • CDisabling write protection on the evidence drive
   • DStoring evidence on a shared network drive
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following is a key element of a chain of custody record?

   • AThe color of the evidence bag
   • BThe signature of the person who handled the evidence
   • CThe brand name of the storage device
   • DThe IP address of the forensic workstation
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following best describes a 'procedure' in the context of TTPs?

   • AThe specific implementation of a technique
   • BThe overall strategy of an adversary
   • CThe category of tools used by an adversary
   • DThe high-level goal of an attack
   Reveal Solution Discussion Select an answer first
5. 39expert · medium

   A security team is investigating a ransomware attack. The attacker initially gained access via a phishing email, then moved laterally to multiple servers, and finally encrypted critical files. The team is mapping the attack to the Cyber Kill Chain. Which phase represents the encryption of files?

   • ACommand and Control
   • BWeaponization
   • CActions on Objectives
   • DInstallation
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   In the MITRE ATT&CK framework, what is the term for the 'why' of an attack—the adversary's goal or objective?

   • AProcedure
   • BTechnique
   • CTactic
   • DMitigation
   Reveal Solution Discussion Select an answer first