Incident Response and Forensics Investigation CND Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an investigation of a suspected data exfiltration, you need to seize a laptop from a user's desk. The laptop is powered on and the user is logged in. Which step should you take to preserve evidence in a legally defensible manner?

   • APhotograph the screen, then perform a live acquisition of volatile data before shutting down the system.
   • BImmediately pull the power cable and remove the battery to freeze the system state.
   • CCopy the user's files to an external drive and then shut down the laptop.
   • DLog off the user and then create a forensic image of the hard drive using a write-blocker.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why must incident responders adhere to legal and ethical standards during an investigation?

   • ATo avoid having to document the investigation
   • BTo reduce the cost of the investigation
   • CTo ensure the evidence is admissible in court and the investigation is lawful
   • DTo speed up the investigation process
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   During triage, which incident should be prioritized first?

   • AAn incident involving a critical server that is actively being exploited
   • BAn incident that is suspected but not confirmed
   • CAn incident that was detected but has been contained
   • DAn incident affecting a single workstation with low data sensitivity
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A malware analyst is analyzing a suspicious binary. Static analysis reveals the binary is packed and contains anti-debugging checks. Dynamic analysis in a sandbox shows the binary creates a mutex named 'Global\MSUpdate' and attempts to connect to an IP address on port 445. What is the best next step to understand the malware's purpose?

   • AAnalyze the network traffic to see what data is sent to the IP address.
   • BRun the binary again with a debugger attached to bypass anti-debugging checks.
   • CUnpack the binary and analyze the unpacked code to identify the malware's functionality.
   • DCheck the mutex name in a malware database to identify the family.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security analyst is correlating logs from a web server, a database server, and a firewall. The web server logs show a SQL injection attempt in the URL. The database logs show an unusual query that returned a large result set. The firewall logs show an outbound connection from the database server to an external IP. What is the most likely attack path?

   • AThe outbound connection is a false positive because the database server is allowed to communicate externally.
   • BThe attacker exploited SQL injection on the web server to extract data from the database and exfiltrated it via an outbound connection.
   • CThe database server was compromised by malware that sent data to an external IP.
   • DThe attacker used a phishing email to gain credentials and accessed the database directly.
   Reveal Solution Discussion Select an answer first