3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An incident responder is investigating a suspected compromise of a smart thermostat on the corporate network. The thermostat has limited storage and no remote logging. The responder needs to preserve evidence for potential legal action. What is the most appropriate evidence collection approach?

   • ADisconnect the device from power immediately to prevent remote tampering.
   • BUse the device's mobile app to export logs and settings to the cloud.
   • CPerform a factory reset to clear any malicious configuration and then capture network traffic.
   • DPhotograph the device state, record all network connections, and carefully extract the device's flash memory using a hardware write blocker.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   During an investigation, an analyst needs to collect evidence from a macOS laptop that is suspected of being compromised. The laptop is currently running. What is the correct order of evidence collection?

   • AImage the disk, then capture memory, then collect logs
   • BCapture memory, then collect disk image, then gather system logs
   • CShut down the laptop, then image the disk and memory
   • DCollect system logs, then capture memory, then image the disk
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a mixed environment of Windows desktops, macOS laptops, and IoT sensors. A security alert indicates that a known malware signature was detected on a Windows desktop. The analyst must investigate the potential intrusion across all platforms. Which approach best balances thoroughness and efficiency?

   • APerform a full forensic image of every endpoint in the company, including all IoT sensors, before analyzing any data.
   • BImmediately quarantine all endpoints and then reimage them from known-good backups.
   • CFocus only on the Windows desktop because the malware signature is Windows-specific and cannot affect other platforms.
   • DPrioritize the Windows desktop for deep forensic analysis, then correlate network logs to identify if the malware communicated with other endpoints, and selectively check IoT sensors for similar IoCs.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst is investigating a Windows machine that is beaconing to an external IP. The analyst wants to identify the process responsible. Which technique would be most effective?

   • AUse netstat to identify the PID associated with the external connection
   • BReview the browser history for the external IP
   • CCheck the Windows Event Log for logon events
   • DRun a full antivirus scan
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   After a multi-endpoint intrusion, the security team has identified the malware, the entry point, and the affected systems. Management asks for a remediation plan that minimizes downtime. What is the best recommendation?

   • AContain affected systems, eradicate the malware, and recover using clean backups
   • BReimage all affected systems immediately without further analysis
   • COnly patch the vulnerabilities and resume normal operations
   • DDisconnect all affected systems and leave them offline indefinitely
   Reveal Solution Discussion Select an answer first