After completing a forensic investigation, you must write a report for legal counsel and senior management. What is the most important element to include to ensure the report is useful for potential litigation?

Recommendations for improving the company's security posture.

A detailed chain of custody documentation for all evidence.

A summary of the costs incurred during the investigation.

A list of all software installed on the forensic workstation.

A company has suffered a ransomware attack. The malware has been contained, but the company's backups are also encrypted. The company has a disaster recovery site with a 24-hour-old replica of the critical systems. The management wants to restore operations as quickly as possible. What is the BEST course of action?

Pay the ransom to get the decryption key and then restore the original systems

Wipe all systems and reinstall from scratch without using the replica

Conduct a full forensic analysis of the original systems before restoring anything

Restore from the disaster recovery replica and then conduct a thorough forensic analysis of the original systems

A malware analyst has obtained a suspicious executable file from an infected host. The analyst wants to understand the malware's behavior without risking infection of the analysis system. Which approach is most appropriate?

Disassemble the executable using a debugger to review the assembly code

Execute the executable directly on the analyst's workstation to observe its effects

Upload the executable to an online multi-scanner to see if it is detected

Run the executable in a sandboxed virtual machine with network monitoring and capture the system calls

A security operations center receives three simultaneous alerts: (1) a single workstation has a known malware signature detected by antivirus, (2) a domain controller shows failed login attempts from a foreign IP, and (3) a database server is exfiltrating data to an external IP. The IR team has limited resources. Which incident should be prioritized for immediate response?

The database server exfiltration

The workstation malware detection

All three equally, because they are all security incidents

The domain controller failed logins

A forensic examiner needs to create a forensic image of a suspect's hard drive. The examiner wants to ensure the image is an exact copy and that the original drive is not altered. Which procedure is correct?

Copy all files from the drive to a new drive using the operating system's copy command

Connect the drive to a write-blocker and create a bit-for-bit image, then compute a hash of both the original and the image

Boot the suspect's computer and use a software imaging tool to create the image

Create a logical image of only the active partitions to save time

EC-CouncilCertified Network Defender

Domain 6Objective 1

Incident Response and Forensics Investigation CND Practice Questions (Page 11)

Part of the Incident Response, Forensics and Continuity domain, which makes up ~13% of our current practice bank.

66questions here

14free pages

15concepts

15 Concepts in This Objective

Incident Response Fundamentals
Incident Response Phases
Incident Response Team Roles
Incident Classification and Triage
Evidence Collection and Preservation
Forensic Imaging and Duplication
Forensic Analysis Techniques
Log Analysis and Correlation
Memory and Volatile Data Analysis
Network Forensics
Malware Analysis Basics
Forensic Reporting and Documentation
Legal and Ethical Considerations
Incident Recovery and Remediation
Lessons Learned and Post-Incident Review

Questions 51–55

51application · medium
After completing a forensic investigation, you must write a report for legal counsel and senior management. What is the most important element to include to ensure the report is useful for potential litigation?
Select an answer first
52expert · hard
A company has suffered a ransomware attack. The malware has been contained, but the company's backups are also encrypted. The company has a disaster recovery site with a 24-hour-old replica of the critical systems. The management wants to restore operations as quickly as possible. What is the BEST course of action?
Select an answer first
53application · medium
A malware analyst has obtained a suspicious executable file from an infected host. The analyst wants to understand the malware's behavior without risking infection of the analysis system. Which approach is most appropriate?
Select an answer first
54expert · hard
A security operations center receives three simultaneous alerts: (1) a single workstation has a known malware signature detected by antivirus, (2) a domain controller shows failed login attempts from a foreign IP, and (3) a database server is exfiltrating data to an external IP. The IR team has limited resources. Which incident should be prioritized for immediate response?
Select an answer first
55application · medium
A forensic examiner needs to create a forensic image of a suspect's hard drive. The examiner wants to ensure the image is an exact copy and that the original drive is not altered. Which procedure is correct?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Incident Response and Forensics Investigation CND Practice Questions (Page 11)

Questions 51–55

After completing a forensic investigation, you must write a report for legal counsel and senior management. What is the most important element to include to ensure the report is useful for potential litigation?

A malware analyst has obtained a suspicious executable file from an infected host. The analyst wants to understand the malware's behavior without risking infection of the analysis system. Which approach is most appropriate?

A forensic examiner needs to create a forensic image of a suspect's hard drive. The examiner wants to ensure the image is an exact copy and that the original drive is not altered. Which procedure is correct?

Keep studying — Incident Response, Forensics and Continuity