During an incident, you suspect a memory-resident malware on a Windows server. You need to capture volatile data for analysis. Which action should you take first?

Run antivirus scan on the server to identify the malware.

Copy the page file to a network share for later analysis.

Shut down the server gracefully to avoid damaging running processes.

Run a memory acquisition tool to dump the RAM contents to an external forensic drive.

Why is hashing used when creating a forensic image?

To index the image for faster searching

To encrypt the image to protect it from unauthorized access

To compress the image for easier storage

To verify the integrity of the image by comparing hash values

An incident responder is collecting evidence from a compromised server that is part of a legal investigation. The server is running and the responder needs to capture volatile data. The responder also needs to create a forensic image of the disk. However, the server is in a remote location and cannot be physically accessed. Which approach is most appropriate?

Power off the server remotely and then have someone remove the disk for imaging

Perform a remote live acquisition of volatile data and a remote forensic image using a tool that supports network acquisition

Ask a local administrator to copy the files to a USB drive and mail it to the forensic lab

Skip the forensic image and rely only on the volatile data capture

A forensic investigator needs to collect evidence from a computer that may contain personal data of European Union citizens. The investigation is in the United States. What must the investigator consider to remain legally compliant?

Ignore data protection laws because the investigation is for a criminal case.

Delete all personal data from the evidence to avoid legal issues.

Only collect data that is directly related to the incident, but no other data.

Ensure that any transfer of personal data complies with applicable data protection regulations, such as GDPR.

EC-CouncilCertified Network Defender

Domain 6Objective 1

Incident Response and Forensics Investigation CND Practice Questions (Page 4)

Part of the Incident Response, Forensics and Continuity domain, which makes up ~13% of our current practice bank.

66questions here

14free pages

15concepts

15 Concepts in This Objective

Incident Response Fundamentals
Incident Response Phases
Incident Response Team Roles
Incident Classification and Triage
Evidence Collection and Preservation
Forensic Imaging and Duplication
Forensic Analysis Techniques
Log Analysis and Correlation
Memory and Volatile Data Analysis
Network Forensics
Malware Analysis Basics
Forensic Reporting and Documentation
Legal and Ethical Considerations
Incident Recovery and Remediation
Lessons Learned and Post-Incident Review

Questions 16–20

16application · easy
During an incident, you suspect a memory-resident malware on a Windows server. You need to capture volatile data for analysis. Which action should you take first?
Select an answer first
17foundation · easy
Why is hashing used when creating a forensic image?
Select an answer first
18foundation · easy
Which of the following is an example of a system artifact that can be analyzed in forensics?
Select an answer first
19expert · hard
An incident responder is collecting evidence from a compromised server that is part of a legal investigation. The server is running and the responder needs to capture volatile data. The responder also needs to create a forensic image of the disk. However, the server is in a remote location and cannot be physically accessed. Which approach is most appropriate?
Select an answer first
20application · medium
A forensic investigator needs to collect evidence from a computer that may contain personal data of European Union citizens. The investigation is in the United States. What must the investigator consider to remain legally compliant?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.

Incident Response and Forensics Investigation CND Practice Questions (Page 4)

Questions 16–20

During an incident, you suspect a memory-resident malware on a Windows server. You need to capture volatile data for analysis. Which action should you take first?

Why is hashing used when creating a forensic image?

Which of the following is an example of a system artifact that can be analyzed in forensics?

A forensic investigator needs to collect evidence from a computer that may contain personal data of European Union citizens. The investigation is in the United States. What must the investigator consider to remain legally compliant?

Keep studying — Incident Response, Forensics and Continuity