Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 9)

Questions 41–43

1. 41application · medium

   An incident responder is analyzing a breach and identifies the following: a known threat group, a custom malware variant, a rented server used as a command-and-control, and the targeted company's database server. The responder wants to use the Diamond Model to structure the analysis. Which element of the Diamond Model is the 'infrastructure'?

   • AThe targeted company's database server
   • BThe rented server used as command-and-control
   • CThe known threat group
   • DThe custom malware variant
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst discovers that an employee's workstation was used to access sensitive files after hours. The company's legal team wants to pursue disciplinary action, so the analyst must preserve evidence in a way that will hold up in court. The workstation is still powered on and the user is logged in. What should the analyst do first?

   • ACreate a forensic image of the hard drive using a write-blocker and hash the image.
   • BRun a full antivirus scan to ensure the system is clean before collecting evidence.
   • CShut down the computer immediately to prevent further changes.
   • DCopy the relevant files to a USB drive and label it with the date and time.
   Reveal Solution Discussion Select an answer first
3. 43expert · hard

   A forensic investigator is called to a scene where a server is still running and the attacker is believed to be actively connected. The legal team wants to preserve evidence for prosecution, but the business wants to minimize downtime. The investigator must decide whether to perform a live acquisition or a dead acquisition. Which consideration is most important in this decision?

   • AA live acquisition is always preferred because it captures volatile data and does not require downtime.
   • BThe investigator should always perform a dead acquisition to ensure the disk is preserved.
   • CThe investigator should always perform a live acquisition to avoid losing any data.
   • DA dead acquisition preserves the most reliable evidence but requires shutting down the server, which may lose volatile data.
   Reveal Solution Discussion Select an answer first