3.3 Describe the Role of Attribution in an Investigation 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the purpose of the chain of custody in a digital investigation?

   • ATo encrypt all evidence so that only the investigator can access it
   • BTo ensure that evidence is collected, handled, and stored in a way that preserves its integrity and admissibility in court
   • CTo prioritize which evidence should be analyzed first
   • DTo automatically back up all evidence to the cloud
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is investigating an attack where the attacker used a zero-day exploit and then quickly moved to exfiltrate data. The attack occurred at 3:00 AM local time and targeted a defense contractor. The analyst has found a file hash that matches a known APT group's toolkit. However, the TTPs also resemble a different group. What should the analyst conclude about attribution?

   • AThe attack is likely from a nation-state actor due to the zero-day exploit and the target.
   • BThe attack cannot be attributed because the TTPs are conflicting.
   • CThe attack is definitely from the APT group whose toolkit was used.
   • DAttribution should be based on the combination of the zero-day, the target, and the TTPs, with moderate confidence.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A forensic investigator is collecting evidence from a compromised server that is still running critical business applications. The investigator needs to preserve evidence for potential legal action, but the business cannot afford downtime. Which approach best balances evidence preservation and business continuity?

   • APerform a live forensic acquisition of volatile data and then take a forensic image of the disk while the system is running.
   • BWait until the business can schedule downtime, then perform a full forensic acquisition.
   • CShut down the server immediately and take a forensic image of the disk.
   • DCopy only the files that are relevant to the investigation and leave the system running.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which characteristic is most commonly used to distinguish a nation-state threat actor from a cybercriminal?

   • AThe primary motivation behind the attack
   • BThe time of day the attack occurs
   • CThe sophistication of the malware used
   • DThe use of a command-and-control server
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Why is asset identification important during the attribution phase of an investigation?

   • AIt is required by law before any investigation can begin
   • BIt allows the organization to immediately block all external network traffic to prevent further damage
   • CIt guarantees that the attacker's identity will be revealed through the asset inventory
   • DIt helps investigators determine which systems and data are most critical, guiding where to focus forensic collection and analysis
   Reveal Solution Discussion Select an answer first