Incident Response and Forensics Investigation CND Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When collecting digital evidence, what is the correct procedure for labeling evidence containers?

   • ALabel with the evidence's contents and value
   • BLabel with the case number only
   • CLabel with the date, time, collector's name, and a unique identifier
   • DLabel with the suspect's name and address
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A forensic report is being prepared for a case involving a disgruntled employee accused of stealing trade secrets. The report must be clear enough for a jury with no technical background. Which approach is most effective?

   • AInclude raw log files and memory dumps as appendices for the jury to review.
   • BFocus only on the final conclusion and omit methodology to avoid confusion.
   • CUse plain language, define technical terms, and include a timeline of events with supporting evidence.
   • DUse technical jargon to demonstrate expertise and credibility.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During an investigation, an incident responder discovers that the compromised system contains personal data of customers. The organization is subject to GDPR. What is the most important legal consideration for the investigation?

   • ANotify all customers before starting the investigation
   • BAvoid collecting any personal data as evidence to simplify the investigation
   • CEnsure that the investigation complies with data protection regulations and that evidence handling respects privacy requirements
   • DDelete all personal data from the compromised system immediately to protect customer privacy
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the difference between static and dynamic malware analysis?

   • AStatic analysis is faster than dynamic analysis
   • BStatic analysis examines the malware without executing it, while dynamic analysis runs the malware in a controlled environment
   • CStatic analysis is used for network malware, while dynamic analysis is used for file-based malware
   • DStatic analysis runs the malware, while dynamic analysis examines the code
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A hospital's network monitoring alerts on a workstation in the cardiology department that is beaconing to a known malware C2 domain. The workstation is used for patient admissions and cannot be taken offline without delaying critical care. The IR team has confirmed the beaconing is malicious but has not yet identified the full scope. Which action should the team take FIRST?

   • AIsolate the workstation from the network while preserving remote access for the IR team
   • BPower off the workstation immediately to preserve volatile evidence
   • CDisconnect the workstation from the network and leave it powered on for the user to continue local work
   • DReimage the workstation from a known-good backup to restore service quickly
   Reveal Solution Discussion Select an answer first