5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   According to NIST SP 800-86, which type of data should be collected FIRST during an incident response investigation?

   • AData stored on a solid-state drive
   • BData stored on a hard disk drive
   • CData stored on external backup media
   • DData stored in memory (RAM)
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic team is about to collect evidence from a Windows machine that was used in a phishing attack. The machine is currently running. Which step should be taken to preserve the evidence on the hard drive?

   • ARemove the hard drive and connect it directly to a forensic workstation without a write-blocker.
   • BUse a hardware write-blocker when connecting the drive to a forensic workstation.
   • CRun a disk cleanup utility to free space before imaging.
   • DBoot the machine normally and copy files to a network share.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic analyst is responding to a critical incident on a database server. The server is still running, but the organization's management wants to shut it down as soon as possible to restore service. The analyst must balance the need to collect evidence with the urgency of restoring operations. Which approach best balances these competing requirements?

   • ACollect memory and network state first, then allow the system to be shut down and image the disk later.
   • BPerform a full disk image while the server is running, then shut down.
   • CImmediately shut down the server and then perform a full disk image.
   • DSkip evidence collection and rely on network logs only.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A forensic examiner needs to collect evidence from a compromised Linux server. The examiner must ensure that the evidence is not altered during collection and that it can be verified later in court. Which procedure best meets these requirements?

   • ABoot the system from a trusted forensic USB drive and create a bit-for-bit image of the hard disk, then compute a SHA-256 hash of the image.
   • BUse the system's built-in backup tool to create a compressed archive of the files.
   • CLog in normally and copy files to an external drive using standard copy commands.
   • DPower off the system immediately and remove the hard drive for imaging in a lab.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic examiner has collected a memory image from a compromised workstation. The examiner needs to ensure that the image has not been altered since collection. What should the examiner do?

   • ARename the image file to a more descriptive name.
   • BStore the image on the same workstation's hard drive.
   • CCalculate a SHA-256 hash of the image and record it in the case notes.
   • DCompress the image to save space.
   Reveal Solution Discussion Select an answer first