Incident Response and Forensics Investigation CND Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   What is the goal of forensic analysis of system artifacts?

   • ATo delete malicious files from the system
   • BTo identify the perpetrator's identity
   • CTo restore the system to its original state
   • DTo identify indicators of compromise and reconstruct the attack timeline
   Reveal Solution Discussion Select an answer first
2. 47application · easy

   You are imaging a suspect's hard drive for forensic analysis. The drive is connected to a forensic workstation via a write-blocker. After imaging, you compute a SHA-256 hash of the original drive and the image file. What is the primary purpose of comparing these hashes?

   • ATo determine the file system type and partition layout of the drive.
   • BTo verify that the image is an exact bit-for-bit copy of the original drive.
   • CTo check whether the drive contains malware signatures.
   • DTo ensure the write-blocker is functioning correctly.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   After a phishing incident that led to a data breach, the incident response team completes the recovery phase. The team is conducting a post-incident review. Which finding should be prioritized for improvement?

   • AThe incident response team was understaffed during the incident.
   • BThe forensic analysis took longer than expected due to the large volume of data.
   • CThe lack of a formal communication plan caused delays in notifying stakeholders.
   • DThe phishing email was not detected by the spam filter.
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   Which tool is commonly used to capture network traffic for forensic analysis?

   • ANmap
   • BWireshark
   • CMetasploit
   • DJohn the Ripper
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A security analyst is investigating a potential breach. The firewall logs show outbound connections to an unusual IP address at 3:00 AM, and the authentication logs show a successful login for a user account at the same time from a different geographic location. The analyst also sees a spike in DNS queries for a domain that is not typically visited. Which conclusion is most strongly supported by correlating these logs?

   • AThe DNS queries are caused by a misconfigured DNS server
   • BThe user's account may be compromised and used to establish a command-and-control channel
   • CThe firewall logs are incorrect and the login is a false positive
   • DThe user is working late and visited a legitimate website
   Reveal Solution Discussion Select an answer first