5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A forensic examiner has completed the collection of evidence from a compromised server. The examiner needs to ensure that the evidence has not been altered during the investigation. Which practice is most important?

   • AMaking multiple copies of the evidence and distributing them to the investigation team
   • BUsing the original evidence for all analysis to avoid copy errors
   • CDocumenting the chain of custody and storing the evidence in a secure location
   • DEncrypting the evidence with a password known to all team members
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An incident responder is called to a site where a server is suspected of being compromised. The server is still powered on. Which order should the responder follow when collecting evidence?

   • ADisk image, memory, network connections, system logs.
   • BNetwork connections, disk image, memory, system logs.
   • CSystem logs, disk image, memory, network connections.
   • DMemory, network connections, disk image, system logs.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A forensic examiner has collected a disk image from a suspect's computer. The examiner needs to prove in court that the image is identical to the original disk. Which action is essential?

   • AStore the image on a network share that is accessible to all investigators.
   • BRecord the hash value of the original disk before imaging and compare it to the hash of the image.
   • CUse a compression tool to reduce the size of the image file.
   • DLabel the image with the date and time of collection.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An incident response team is preparing to collect evidence from a server that is part of a legal investigation. The team wants to ensure that the evidence is preserved in a way that is acceptable in court. Which practice is most aligned with NIST SP 800-86?

   • ARun a live analysis tool on the server to gather information.
   • BCopy only the files that appear relevant to the incident.
   • CTake screenshots of the server's screen and log them.
   • DCreate a forensic image of the disk and verify its hash.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A forensic examiner is called to a site where a server was compromised. The server is running, but the organization's legal team wants to ensure that evidence is preserved in a way that will hold up in court. The examiner has limited time because the server must be returned to production soon. Which combination of actions best preserves evidence while meeting the time constraint?

   • ACapture memory, then create a forensic image of the disk using a write-blocker, and hash all collected data.
   • BTake a photograph of the server's screen and then reboot it.
   • CCopy only the files related to the incident to an external drive.
   • DRun a live analysis tool to gather information and then shut down the server.
   Reveal Solution Discussion Select an answer first