3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is investigating a suspected intrusion on an employee's Android smartphone. The phone is locked with a PIN, and the analyst needs to extract data for evidence. What is the most appropriate approach?

   • APerform a physical extraction without unlocking the device
   • BRemove the SIM card and analyze it only
   • CUse a forensic tool that supports Android logical extraction after unlocking the device with the user's consent
   • DConnect the phone to a PC and browse the file system manually
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An incident responder is investigating a suspected intrusion on a company-issued iPhone that is enrolled in Apple Business Manager. The device is suspected of being compromised via a phishing link. The responder needs to collect evidence while preserving chain of custody and minimizing business disruption. Which approach is most appropriate?

   • AAsk the user to back up the device to iCloud and then analyze the backup.
   • BErase the device remotely using Apple Business Manager to ensure any malware is removed.
   • CPlace the device in a Faraday bag and then perform a physical acquisition.
   • DPerform a logical acquisition using a forensic tool while the device is in airplane mode, and document the device's unique identifiers and current state.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard · select all that apply

   An organization is investigating a potential intrusion that involves a Windows laptop, an Android smartphone, and a smart TV. The security team must collect evidence from all three platforms. Which of the following are appropriate evidence collection methods for these platforms? (Select all that apply.)

   • AImage the Windows laptop's hard drive
   • BPerform a logical extraction of the Android smartphone
   • CRemove the SIM card from the Android phone and analyze it only
   • DCapture network traffic from the smart TV
   • EPerform a memory dump on the smart TV
   Check answers Discussion Select an answer first
5. 4expert · hard

   A company discovers that a phishing email was opened on a Windows laptop and an Android smartphone. The laptop shows a Trojan, and the smartphone has a suspicious app. The security team has limited time and resources. What is the most efficient approach to determine if the same attacker is behind both infections?

   • AWipe both devices and reimage them
   • BCompare the command-and-control IP addresses and domain names from both devices
   • CPerform a full forensic analysis of both devices independently
   • DInterview the user about both devices
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A forensic team is investigating a breach that involves a Windows server and an IoT device. The team must collect evidence without violating data privacy regulations. What is the most important consideration?

   • ACollect all data from both devices to ensure nothing is missed
   • BUse the fastest collection method available
   • CAvoid collecting data from the IoT device because it may contain personal data
   • DEnsure that evidence collection is authorized and limited to relevant data
   Reveal Solution Discussion Select an answer first