Computer Forensics and Incident Response ACCISO Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the primary purpose of a forensic report?

   • ATo document the investigation process and findings in a clear and concise manner
   • BTo advertise the capabilities of the forensic team
   • CTo store raw data for future analysis
   • DTo provide a technical guide for other investigators
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is the purpose of the eradication phase in incident response?

   • ATo restore data from backups
   • BTo remove the threat from the affected systems
   • CTo document lessons learned
   • DTo identify the scope of the incident
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security analyst detects unusual outbound traffic from a server that stores sensitive data. The traffic pattern matches a known data exfiltration technique. The analyst must decide whether to block the traffic immediately or continue monitoring. Which decision is most appropriate?

   • ABlock the outbound traffic immediately to stop data loss.
   • BBlock the traffic and simultaneously begin forensic preservation of the server.
   • CContinue monitoring to gather more evidence about the exfiltration.
   • DIgnore the traffic because it may be a false positive.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the purpose of triage in incident response?

   • ATo collect forensic evidence
   • BTo permanently delete malicious files
   • CTo determine the severity and priority of an incident
   • DTo restore systems from backups
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A forensic examiner is collecting evidence from a crime scene. The examiner must ensure the evidence is admissible in court. Which action is most important?

   • ACollect only the evidence that seems most relevant.
   • BKeep the evidence in a secure location without documentation.
   • CDocument every action taken and maintain a chain of custody.
   • DUse the fastest collection method available.
   Reveal Solution Discussion Select an answer first