3.3 Describe the Role of Attribution in an Investigation 200-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the context of a cybersecurity investigation, what is the most accurate definition of an 'asset'?

   • AOnly the servers and network devices that are directly connected to the internet
   • BAny data, device, or other component that supports the organization's information-related activities and has value to the organization
   • CAny piece of hardware that has been assigned an IP address
   • DThe set of all files that have been accessed by an attacker during an incident
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An incident response team is investigating a malware infection on a server. The team has identified the malware's command-and-control (C2) domain and a unique registry key it creates. To support attribution, what should the team do with this information?

   • ADocument the C2 domain and registry key in the incident report but do not share them externally.
   • BUse the registry key to identify the specific server and then reimage the server.
   • CUse the C2 domain and registry key as IOCs and correlate them with threat intelligence feeds.
   • DImmediately block the C2 domain and delete the registry key to contain the infection.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How do indicators of compromise (IOCs) support attribution in an investigation?

   • ABy providing the attacker's real name and physical address
   • BBy matching IOCs from the incident to known threat intelligence, investigators can link the attack to a specific threat actor or group
   • CBy automatically blocking all traffic from the attacker's IP address
   • DBy proving that the attack originated from a specific country
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary difference between an indicator of attack (IOA) and an indicator of compromise (IOC)?

   • AIOAs are always network-based, while IOCs are always host-based
   • BIOAs focus on the intent and actions of an attacker in real time, while IOCs are evidence of a past compromise
   • CIOAs are generated by antivirus software, while IOCs are generated by firewalls
   • DIOAs are used for attribution, while IOCs are used for containment
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An organization is preparing to take legal action against a former employee who allegedly installed a backdoor. The incident response team has collected logs and a memory dump from the employee's workstation. What is the most important reason to maintain a detailed chain of custody for this evidence?

   • ATo demonstrate that the evidence has not been tampered with and to maintain its admissibility in court.
   • BTo ensure that the evidence is backed up and can be restored if the original is lost.
   • CTo allow multiple analysts to work on the same evidence without affecting the investigation.
   • DTo ensure that the evidence is stored in a secure location and cannot be accessed by unauthorized personnel.
   Reveal Solution Discussion Select an answer first