3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An incident responder is investigating a suspected intrusion on a Windows desktop that is part of a domain. The responder needs to collect forensic evidence while preserving chain of custody. Which action is most appropriate?

   • APower off the system and remove the hard drive without documenting the system state.
   • BRun a full antivirus scan and then delete any detected malware.
   • CCopy the entire hard drive to a network share using standard Windows copy commands.
   • DCreate a forensic image of the hard drive using a write-blocker and record the SHA-256 hash of the image.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An incident responder is investigating a suspected intrusion on a macOS laptop that is used by an executive. The laptop is encrypted with FileVault. The responder needs to collect evidence while the laptop is powered on and the user is logged in. Which approach best preserves evidence and maintains chain of custody?

   • APower off the laptop and remove the SSD for imaging, assuming FileVault will not prevent access.
   • BPerform a live acquisition using a forensic tool that captures memory and logical files while the user is logged in, and document the acquisition process.
   • CCopy the user's home folder to an external drive using Finder.
   • DAsk the user to disable FileVault so that a full disk image can be created.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Why is correlating findings from multiple endpoints important in an intrusion investigation?

   • ATo determine which endpoint is the most expensive to replace
   • BTo reduce the number of alerts that need to be investigated
   • CTo identify the full scope of the intrusion across the network
   • DTo ensure that all endpoints have the same security software installed
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An incident responder is investigating a suspected intrusion on a Linux-based IoT device that is part of a critical infrastructure network. The device has limited storage and no write-blocker available. The responder needs to collect evidence without causing downtime. Which approach is most appropriate?

   • ACapture network traffic to and from the device and use the device's built-in logging to collect relevant logs, while documenting the device's state.
   • BReset the device to factory defaults and then capture logs from the management console.
   • CPerform a live acquisition using dd over the network to an external server.
   • DPower off the device and remove its flash memory for imaging using a hardware programmer.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security team is investigating a breach that affected multiple Windows and Linux servers. The team has collected logs from each server. What is the most effective way to identify the full scope of the intrusion?

   • ACorrelate timestamps and IP addresses across all server logs to identify common attack patterns
   • BAnalyze each server's logs independently and report separately
   • CCheck the firewall logs only
   • DFocus on the server with the most critical data
   Reveal Solution Discussion Select an answer first