5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is responding to a ransomware incident on a critical server. The server is still running, but the analyst knows that the system may be shut down by the IT team soon. Which data should the analyst collect first?

   • AThe contents of RAM, including running processes and open network connections.
   • BThe configuration files of the operating system.
   • CThe system event logs from the last 24 hours.
   • DThe full disk image of the server.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An incident response team is responding to a suspected advanced persistent threat on a critical database server. The server is running, but the team has been told that the server must be patched and rebooted within the hour to meet a business SLA. The team needs to collect evidence that will be used in a legal case. Which approach best balances the need to collect evidence with the business requirement?

   • ASkip volatile data collection and only image the disk after the reboot.
   • BImage the disk first, then collect volatile data after the reboot.
   • CRefuse to allow the reboot until all evidence is collected, including a full disk image.
   • DCollect volatile data (memory, network connections, running processes) first, then allow the reboot, and later image the disk.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is collecting evidence from a server that was compromised. The examiner wants to ensure that the evidence is not accidentally modified during the collection process. Which tool or technique should be used?

   • AA network sniffer to capture traffic.
   • BA remote desktop session to view the server's screen.
   • CA write-blocker when imaging the hard drive.
   • DA system restore point.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security analyst is responding to an incident on a server that is part of a critical production environment. The server is running, but the analyst has been instructed to minimize downtime. The analyst needs to collect evidence that will be used for internal investigation, not for court. Which action is the most appropriate?

   • AImmediately power off the server to preserve the disk state.
   • BPerform a full disk image while the server is still running.
   • CSkip volatile data collection and only collect logs from the server.
   • DCollect volatile data using built-in tools, then image the disk after the server is taken offline during a planned maintenance window.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   An incident responder is investigating a suspected insider threat on a user's workstation. The workstation is running, but the user is about to log off, which may terminate critical processes. The responder has remote access and must collect evidence without alerting the user. Which action is the most appropriate?

   • AWait for the user to log off and then collect evidence from the disk.
   • BCapture the contents of memory and active network connections before the user logs off.
   • CSend a message to the user asking them to stay logged on.
   • DRemotely shut down the workstation immediately.
   Reveal Solution Discussion Select an answer first