Computer Forensics and Incident Response ACCISO Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's security team detects ransomware on one workstation. The malware is encrypting files and attempting to spread to other hosts. The team wants to stop the spread while preserving evidence for later analysis. Which action should the team take first?

   • ADisconnect the workstation from the network and isolate it from other systems.
   • BDelete the ransomware executable from the workstation immediately.
   • CRun a full antivirus scan and let it remove all detected threats.
   • DReboot the workstation to clear the malware from memory.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A SOC analyst is triaging alerts from multiple sources. The following alerts have been raised: (1) A user account has been locked out after multiple failed attempts. (2) A domain admin account has successfully logged in from a new IP address. (3) A workstation has been flagged for downloading a suspicious file. (4) An email phishing attempt was blocked by the gateway. Which alert should be prioritized for immediate investigation?

   • AThe user account lockout.
   • BThe domain admin login from a new IP address.
   • CThe blocked phishing email.
   • DThe suspicious file download.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A forensic examiner is working on a case that involves data from a cloud service. The data is stored in a different country. The examiner must ensure the evidence is admissible in the home country's court. Which consideration is most important?

   • AThe data can be accessed remotely without any legal process.
   • BThe examiner must comply with the laws of both the home country and the country where the data is stored.
   • CThe data must be physically transferred to the home country for analysis.
   • DThe cloud provider's terms of service are sufficient for legal admissibility.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A forensic examiner completed an investigation and must write a report that will be used in legal proceedings. The report must be understandable to non-technical stakeholders. Which practice is most important?

   • AFocus only on the final conclusion and omit methodology.
   • BWrite the report in plain language with a clear summary of findings and evidence.
   • CUse technical jargon to demonstrate expertise.
   • DInclude every technical detail and raw log output to show thoroughness.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary ethical obligation of a forensic investigator?

   • ATo use the most advanced forensic tools available
   • BTo share findings with all interested parties
   • CTo ensure that the investigation is completed as quickly as possible
   • DTo maintain objectivity and avoid bias in the investigation
   Reveal Solution Discussion Select an answer first