3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company suffered a data breach that was traced to a vulnerability in a third-party application. The vendor has released a patch, but the company cannot apply it immediately because the application is critical to operations. Which action is most appropriate to mitigate the risk while the patch is pending?

   • ADisable the application until the patch is applied
   • BImplement compensating controls such as network segmentation and access restrictions
   • CApply the patch during the next maintenance window
   • DIncrease monitoring of the application and its logs
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   When collecting digital evidence from a compromised server, which action is essential to maintain forensic soundness?

   • AUse the server's built-in tools to examine live data
   • BCopy files to a shared network drive for convenience
   • CCreate a cryptographic hash of the original evidence before analysis
   • DRun a full antivirus scan on the server before imaging
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst is assigned to investigate a case where a user's workstation was used to upload proprietary source code to a public repository. The user denies any involvement. What type of case is this, and what is the first step?

   • AExternal attack case; block the public repository immediately.
   • BPolicy violation case; terminate the user's employment immediately.
   • CInsider threat case; collect and preserve evidence from the workstation and network logs.
   • DData breach case; notify all customers immediately.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an investigation, an analyst needs to collect evidence from a server that is part of a critical production environment. The server cannot be taken offline. What is the most appropriate evidence collection method?

   • APerform a live acquisition of the server's memory and relevant logs while it remains online.
   • BTake a photo of the server's screen and note the running processes.
   • CShut down the server and create a forensic image of the hard drive.
   • DCopy the server's configuration files to a USB drive.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company suffered a ransomware attack. The investigation reveals that the initial access was through a VPN account that had MFA enabled. The user's phone received a push notification at the time of the attack, but the user did not approve it. The attacker used a 'push bombing' technique to fatigue the user into approving. Which root cause is most likely?

   • AThe VPN account password was weak and easily guessed.
   • BThe user's phone was infected with malware that intercepted the MFA code.
   • CThe MFA implementation lacked number matching or other phishing-resistant controls.
   • DThe VPN software had a known vulnerability that bypassed MFA.
   Reveal Solution Discussion Select an answer first