3.2 Determine the Steps to Investigate the Common Types of Cases 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   After an investigation, an analyst must write a report for a regulatory body. The report must demonstrate that the company took appropriate actions. What is the most important element to include?

   • AA recommendation to increase the security budget.
   • BA detailed timeline of the investigation and the actions taken to contain and remediate the incident.
   • CThe names of all employees involved in the incident.
   • DThe exact commands used by the attacker during the intrusion.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A forensic investigator needs to collect the contents of a server's memory as part of an incident investigation. The server is running a critical production service. What is the most appropriate method to collect the memory evidence?

   • APower off the server and remove the RAM modules
   • BUse a trusted memory acquisition tool to capture the RAM contents
   • CTake a photo of the server's screen showing running processes
   • DCopy the pagefile.sys file from the hard drive
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An analyst is investigating a suspected data exfiltration. Network logs show large outbound transfers to an unusual IP address. Which data analysis technique would best help confirm the exfiltration?

   • ACheck the reputation of the destination IP address using a threat intelligence feed.
   • BCalculate the average transfer size over the past year to identify anomalies.
   • CCorrelate the outbound transfers with user authentication logs and file access events.
   • DRun a full packet capture on the network for the next 24 hours.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   An analyst is investigating a breach where an attacker exfiltrated data over DNS queries. The logs show a large number of TXT record queries to a domain that is not used by the company. The analyst must determine the root cause and scope. Which combination of techniques is most effective?

   • ACorrelate the DNS queries with the source IP addresses and identify which hosts generated the queries.
   • BAnalyze the TXT record content to decode the exfiltrated data.
   • CCheck the domain's WHOIS information to identify the attacker.
   • DBlock the malicious domain at the firewall and assume the issue is resolved.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   After investigating a malware infection, an analyst must report findings to both the IT team and executive leadership. What is the most effective way to structure the report?

   • ASend the raw log data to both groups so they can draw their own conclusions.
   • BProvide a single technical report with detailed IoCs and forensic artifacts.
   • CVerbally brief the executives and send the full report only to IT.
   • DCreate an executive summary with business impact and a separate technical appendix for the IT team.
   Reveal Solution Discussion Select an answer first