Computer Forensics and Incident Response ACCISO Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A company's security team has just detected a data breach involving customer records. The team must respond. Which activity is part of the incident response process?

   • AImmediately notify all customers and the media.
   • BContain the breach, eradicate the threat, and recover affected systems.
   • CDelete all logs to prevent the attacker from accessing them.
   • DIgnore the breach until the next business day.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A security analyst observes multiple failed login attempts to a critical database server from a single external IP, followed by a successful login. The analyst must classify the incident and decide the immediate response. Which classification and action is most appropriate?

   • AHigh severity; terminate the session, reset credentials, and begin forensic preservation.
   • BLow severity; document the event and continue normal operations.
   • CMedium severity; monitor the session and gather additional evidence before acting.
   • DHigh severity; isolate the database server from the network immediately.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the primary goal of computer forensics in the context of incident response?

   • ATo recover deleted files from compromised systems
   • BTo restore systems to their normal operational state after an incident
   • CTo identify and prosecute the perpetrator of a cybercrime
   • DTo preserve and analyze digital evidence in a manner that maintains its integrity and admissibility
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In the context of incident response, what is the primary role of computer forensics?

   • ATo provide legal representation for the organization during litigation
   • BTo communicate with law enforcement and regulatory bodies
   • CTo immediately contain the threat and prevent further damage
   • DTo identify the root cause of the incident and preserve evidence for potential legal action
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   What is the function of a write-blocker in forensic imaging?

   • ATo prevent any data from being written to the original storage media
   • BTo encrypt the data being copied
   • CTo compress the data being copied
   • DTo speed up the imaging process
   Reveal Solution Discussion Select an answer first