3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A database administrator notices that a large number of records were deleted from a customer table. The database has native audit logging enabled. Which evidence would BEST help determine whether the deletion was due to a SQL injection attack or a privileged user's mistake?

   • AThe database audit logs showing the exact SQL statements executed and the user accounts that ran them.
   • BThe backup logs showing when the last backup was taken.
   • CThe database's error logs showing any failed queries.
   • DThe network traffic captures to the database server.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   A security analyst is investigating a potential data loss incident in a cloud environment. Which cloud-specific vector is most likely to cause data exposure?

   • AMalware infection on a user's laptop
   • BMisconfigured storage bucket with public read access
   • CPhysical theft of a server from the data center
   • DSQL injection on a web application
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   A server administrator notices unusual file system activity on a file server. Which server data loss vector should be investigated first?

   • ASQL injection on a web application
   • BMisconfigured cloud storage
   • CUnauthorized access via compromised credentials
   • DRemovable media on an endpoint
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   During a data loss investigation, an analyst collects log files from a server and stores them on a shared network drive. Which practice is essential to maintain chain of custody?

   • AMake the logs read-only for all users except the investigator.
   • BRecord who collected the logs, when, and from which system, and store them in a secure location with access logging.
   • CDelete the original logs after copying them to the network drive.
   • DEmail the logs to the legal team for safekeeping.
   Reveal Solution Discussion Select an answer first
6. 50expert · hard

   A security investigator is collecting evidence from a compromised server. The investigator needs to preserve the evidence for a legal proceeding. The server is still running, and the investigator must decide whether to shut it down or perform a live acquisition. Which action is most appropriate?

   • ADisconnect the server from the network and leave it running.
   • BShut down the server immediately to preserve the disk evidence.
   • CPerform a live acquisition of the server's memory and then shut down the server to preserve the disk evidence.
   • DCopy the entire disk while the server is running.
   Reveal Solution Discussion Select an answer first