Computer Forensics and Incident Response ACCISO Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company experiences a ransomware attack that encrypts files on multiple servers. The incident response team has isolated the affected servers. The company has backups, but the last backup was 24 hours old. The team needs to restore operations quickly while preserving evidence for law enforcement. What is the BEST course of action?

   • AWipe the affected servers and reinstall the operating system from scratch.
   • BPay the ransom to get the decryption keys and restore the systems.
   • CImmediately restore all servers from backups without preserving the affected systems.
   • DPreserve the affected servers for forensic analysis, then restore from backups on clean systems.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is reviewing alerts from multiple sources. Which alert should be classified as the HIGHEST severity?

   • AA successful login from a foreign country for a domain administrator account at 3:00 AM.
   • BA network scan from an internal IP address to multiple hosts.
   • CA single failed login for a standard user account.
   • DAn antivirus alert for a potentially unwanted program on a user workstation.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why should a forensic report be written in a way that is understandable to non-technical audiences?

   • ABecause the report may be used in legal proceedings where judges and juries may not have technical expertise
   • BBecause forensic reports are public documents
   • CBecause non-technical audiences are the primary readers of forensic reports
   • DBecause technical audiences do not need detailed information
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic examiner has completed an investigation and is writing the final report. The report will be used in a civil lawsuit. The examiner must ensure the report is defensible in court. What is the MOST important element to include?

   • ARecommendations for improving the company's security posture.
   • BA clear chain of custody and a detailed methodology of the forensic process.
   • CA list of all tools used in the investigation.
   • DA summary of the findings and conclusions.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a forensic analysis of a Windows system image, an examiner finds that a user's document folder appears empty, but the file system metadata suggests files were recently deleted. Which technique is most likely to recover the contents of these deleted files?

   • AUse a data recovery tool that scans the MFT for orphaned entries and marks them as active.
   • BCarve the unallocated space of the image for file signatures and reconstruct files from data runs.
   • CRun a CHKDSK repair on the forensic image to fix the file system and reveal the files.
   • DRestore the system to a previous restore point from Windows System Restore.
   Reveal Solution Discussion Select an answer first