Incident Response and Forensics Investigation CND Practice Questions (Page 12)

Questions 56–60

1. 56foundation · easy

   Why is it important to capture volatile memory data before powering off a compromised system?

   • AVolatile data is automatically backed up to the cloud
   • BVolatile data is encrypted and cannot be read after shutdown
   • CVolatile data is lost when the system is powered off
   • DVolatile data is stored on the hard drive and can be recovered later
   Reveal Solution Discussion Select an answer first
2. 57foundation · easy

   What is the purpose of containment strategies in incident response?

   • ATo identify the attacker's identity
   • BTo restore systems to their normal state
   • CTo limit the damage and prevent the incident from spreading
   • DTo permanently delete all affected files
   Reveal Solution Discussion Select an answer first
4. 58expert · hard

   A memory dump from a compromised Windows server reveals a suspicious process that is not present in the file system. The process has an open TCP connection to an external IP. The analyst needs to determine if the process is malicious. Which combination of analyses would provide the STRONGEST evidence?

   • ASearch the memory dump for the process name in the system's event logs
   • BCorrelate the process's memory strings with known malware indicators and check the external IP against threat intelligence feeds
   • CRun a full antivirus scan on the memory dump file
   • DCheck the process's parent process ID and compare it to a list of known good processes
   Reveal Solution Discussion Select an answer first
5. 59foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo create a backup copy of the evidence
   • BTo ensure the evidence is stored in a secure location
   • CTo document who handled the evidence and when, ensuring its integrity and admissibility in court
   • DTo encrypt the evidence to prevent unauthorized access
   Reveal Solution Discussion Select an answer first
6. 60application · medium

   During a forensic investigation of a suspected data exfiltration, an analyst needs to collect evidence from a Linux server that is still running. The server hosts a critical application that cannot be stopped. Which evidence collection approach best preserves the integrity of the evidence?

   • APerform a live acquisition of volatile data and create a forensic image of the disk using a write-blocker
   • BShut down the server and remove the hard drive for imaging in a lab
   • CRun a memory dump and then reboot the server to clear any malware
   • DCopy the relevant files to a USB drive using standard copy commands
   Reveal Solution Discussion Select an answer first