3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst discovers that an employee's workstation was used to access sensitive customer data at 2:00 AM. The analyst must preserve evidence for a potential legal case. The workstation is still powered on and the user is logged in. Which action should the analyst take first?

   • APower off the workstation immediately to prevent further data changes.
   • BRun a live antivirus scan to check for malware before imaging.
   • CCopy the relevant files to a USB drive and label it with the case number.
   • DCreate a forensic image of the hard drive using a write-blocker.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An analyst is reviewing logs from a web server that was defaced. The logs show a series of requests to a vulnerable endpoint, followed by a change to the homepage. Which data analysis technique would best identify the attack vector?

   • AAnalyze the requests to the vulnerable endpoint to identify the payload used.
   • BCompare the homepage file's hash to the original version.
   • CCheck the server's uptime to see when it was last rebooted.
   • DReview the server's error logs for any 500 errors.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company experienced a ransomware attack that encrypted files on multiple servers. The incident response team restored the systems from backups, but the attack recurred. The team suspects that the initial infection vector was a phishing email, but they have not confirmed it. Which approach would be most effective to determine the root cause and prevent recurrence?

   • AImmediately change all user passwords and enforce multi-factor authentication
   • BIncrease the frequency of backups to minimize data loss
   • CReimage all servers and apply the latest security patches
   • DConduct a thorough analysis of the phishing email and trace the attacker's actions
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is investigating a malware outbreak. The malware is communicating with a command-and-control (C2) server. Which data analysis technique would be most effective in identifying the scope of the infection?

   • ACheck the malware's hash against a threat intelligence feed.
   • BCorrelate network logs to identify all internal hosts that communicated with the C2 server.
   • CBlock the C2 server's IP address at the firewall.
   • DAnalyze the malware's code to determine its capabilities.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary goal of root cause analysis in a security incident investigation?

   • ARestore systems to normal operation quickly
   • BAssign blame to the responsible employee
   • CCollect evidence for legal prosecution
   • DIdentify the underlying reason the incident occurred
   Reveal Solution Discussion Select an answer first