Computer Forensics and Incident Response ACCISO Practice Questions (Page 12)

Questions 56–60

1. 56application · medium

   An incident response team is called to a server that may have been compromised. The team needs to preserve evidence for a potential lawsuit. Which sequence of actions best follows the forensic process?

   • AIdentify the incident, preserve the system state, collect volatile data, then create a forensic image.
   • BReboot the server to clear any malicious processes, then image the drive.
   • CRun antivirus scans and remove threats before collecting evidence.
   • DCreate a forensic image first, then collect volatile data.
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   Which of the following is the correct order of the forensic investigation process?

   • AExamination, Collection, Preservation, Analysis, Identification, Reporting
   • BCollection, Preservation, Identification, Analysis, Examination, Reporting
   • CPreservation, Identification, Collection, Examination, Reporting, Analysis
   • DIdentification, Preservation, Collection, Examination, Analysis, Reporting
   Reveal Solution Discussion Select an answer first
4. 58application · medium

   A SOC analyst sees two alerts: (1) a single failed login for a standard user, and (2) multiple successful logins from an unusual geographic location for a domain administrator account. Which alert should be prioritized for immediate response?

   • AThe failed login, because it indicates a brute-force attack in progress.
   • BBoth equally, because any login anomaly should be treated as a critical incident.
   • CThe unusual administrator logins, because they indicate a likely account compromise with high impact.
   • DNeither, because logins are not a reliable indicator of compromise.
   Reveal Solution Discussion Select an answer first
5. 59application · medium

   A forensic investigator is called to a scene where a computer is running and the user is suspected of downloading illegal content. The investigator must collect evidence in a way that is admissible. Which sequence of actions best follows the forensic process?

   • AIdentify the evidence, preserve volatile data, create a forensic image, and then analyze the image.
   • BCopy the user's files to an external drive and then analyze them.
   • CImmediately shut down the computer and then create a forensic image.
   • DRun a live analysis tool on the system to find evidence, then document findings.
   Reveal Solution Discussion Select an answer first
6. 60foundation · easy

   Which of the following is a common technique used to recover deleted files from a file system?

   • ACarving based on file signatures
   • BRebuilding the partition table from scratch
   • CDecrypting the entire disk with a single key
   • DAnalyzing network traffic to reconstruct files
   Reveal Solution Discussion Select an answer first