3.5 Determine the Steps to Investigate Potential Endpoint Intrusion Across a Variety of Platform Types Such as Desktop, Laptop, IoT, Mobile Devices 350-201 Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A forensic investigator is collecting evidence from a compromised server. The investigator needs to ensure the evidence is admissible in court. Which practice is most important?

   • AKeep the evidence on the original system to avoid copying errors
   • BCollect evidence only after business hours
   • CUse the fastest available storage device for the image
   • DDocument every action taken and maintain a chain of custody log
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   What is the primary purpose of maintaining a chain of custody during evidence collection?

   • ATo speed up the forensic analysis process
   • BTo encrypt the evidence so that only authorized analysts can view it
   • CTo reduce the amount of data that needs to be collected
   • DTo ensure the evidence is admissible in legal proceedings
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a key challenge when investigating an intrusion on an IoT device compared to a desktop?

   • AThe need to image the hard drive
   • BThe need to recover deleted emails
   • CThe requirement to analyze browser history
   • DLimited storage and logging capabilities
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   During an investigation of a compromised Linux server, an analyst collects log files and copies them to a USB drive. The analyst then modifies the original logs to remove false positives. Later, the case is escalated to legal. What is the most critical issue with the analyst's actions?

   • AThe analyst should have encrypted the USB drive
   • BThe analyst did not use a write blocker when copying the logs
   • CThe original evidence was altered, breaking chain of custody
   • DThe USB drive may not have enough storage capacity
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A security analyst is investigating a potential intrusion that started on a corporate laptop and may have spread to a smart TV and a mobile phone. The analyst has collected logs from the laptop and the mobile phone, but the smart TV has no logging capability. Which approach best determines if the smart TV was compromised?

   • AAssume the smart TV is not compromised because it has no logging capability.
   • BInterview the user to ask if they noticed any unusual behavior on the smart TV.
   • CCorrelate network traffic logs from the firewall and wireless controller to see if the smart TV communicated with the same malicious IP addresses as the laptop and phone.
   • DPerform a physical acquisition of the smart TV's flash memory using a chip-off technique.
   Reveal Solution Discussion Select an answer first