Computer Forensics and Incident Response ACCISO Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A forensic examiner is preparing to analyze a hard drive that contains personal data of customers. The examiner is working under a court order. What ethical and legal consideration is MOST important?

   • AStore the evidence in a personal cloud account for easy access.
   • BShare the findings with other departments to speed up the investigation.
   • CLimit the analysis to the scope defined in the court order and protect the privacy of unrelated data.
   • DUse the most advanced forensic tools available to extract as much data as possible.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   After a security incident, the incident response team is writing a report for the company's board of directors. What is the most appropriate way to present the findings?

   • AAvoid mentioning the incident to prevent panic among board members.
   • BProvide a high-level summary with key findings, impact, and recommended actions.
   • CFocus on the technical root cause and the tools used in the investigation.
   • DInclude all raw log data and technical details for transparency.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company's web server is compromised and is serving malware to visitors. The incident response team needs to stop the immediate threat while preserving evidence for analysis. Which containment strategy is most appropriate?

   • ATake the server offline and disconnect it from the network.
   • BRebuild the server from a known-good image and restore data from backups.
   • CPatch the vulnerability and restart the web service.
   • DBlock the malicious URL at the firewall and keep the server running for monitoring.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo ensure that the evidence is stored in a secure location
   • BTo document every person who handled the evidence and when, ensuring its integrity and admissibility
   • CTo create a backup copy of the evidence for disaster recovery
   • DTo encrypt the evidence to prevent unauthorized access
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst detects unusual outbound traffic from a finance workstation to an unknown IP address. The workstation is part of a domain and contains sensitive data. Which action should the analyst take FIRST in the incident response process?

   • AIsolate the workstation from the network while preserving volatile data.
   • BRebuild the workstation from a known-good image to ensure the threat is removed.
   • CImmediately shut down the workstation to stop the malicious activity.
   • DCapture a memory dump and network connections, then disconnect the workstation from the network.
   Reveal Solution Discussion Select an answer first