3.8 Determine the Steps to Investigate Potential Data Loss from a Variety of Vectors of Modality Such as Cloud, Endpoint, Server, Databases, Application 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A Linux file server has an unusual number of failed SSH logins followed by a successful login from an unrecognized IP, and then several files were deleted. The server is still running. Which step should be part of the investigation workflow?

   • AChange the SSH port to prevent further unauthorized access.
   • BRestore the deleted files from backup immediately and then investigate the logs.
   • CReboot the server to clear any malicious processes from memory.
   • DReview authentication logs and correlate the successful login time with file deletion timestamps.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A server experienced a data breach. The server hosts a critical application and cannot be taken offline for more than 30 minutes. The investigator needs to collect evidence while minimizing downtime. Which evidence collection strategy is BEST?

   • AUse a remote forensic tool to image the disk over the network while the server remains online.
   • BCopy the application logs to a network share and then reboot the server.
   • CPerform a live forensic collection of volatile data and relevant logs, then schedule a full disk image during the next maintenance window.
   • DTake the server offline immediately and perform a full disk image.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A server administrator notices that a large number of files in a shared network folder have been renamed to include a '.encrypted' extension. The server logs show an unusual login from an account that has not been used in months. The administrator suspects ransomware. Which step should be taken first to investigate the potential data loss?

   • ARestore the encrypted files from the most recent backup immediately.
   • BIsolate the server from the network and preserve the server's logs and file system metadata.
   • CRun an antivirus scan on the server to identify the ransomware variant.
   • DChange the password of the compromised account and notify the account owner.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   An employee reports that a USB drive containing sensitive customer data was lost. The endpoint security logs show that the USB drive was used on the employee's laptop, but the logs do not show which files were copied. The company requires a full investigation to determine the scope of the data loss. Which action should the investigator take next?

   • AAcquire a forensic image of the laptop's hard drive and analyze the file system for artifacts related to the USB drive.
   • BReview the employee's email logs to see if they sent the data to a personal account.
   • CInterview the employee to ask which files were copied to the USB drive.
   • DCheck the USB drive's serial number in the endpoint logs to identify the manufacturer.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company uses a multi-cloud environment with AWS and Azure. An investigation reveals that a storage bucket in AWS and a storage container in Azure both contain sensitive data that was accessed by an external party. The security team must determine the scope of the data loss, but the logs are stored in different formats and locations. Which approach is most effective?

   • ANormalize the logs from both cloud providers into a common format and correlate them based on user identity and timestamp.
   • BFocus only on the AWS logs because the data loss was first detected there.
   • CRequest the cloud providers to provide a combined report of all access logs.
   • DInvestigate the AWS logs first, then the Azure logs, and combine the findings manually.
   Reveal Solution Discussion Select an answer first