What is the primary purpose of a post-incident review (lessons learned)?

To determine the financial cost of the incident

To identify improvements in the incident response process

To delete all evidence related to the incident

A network forensic analyst is examining a pcap file from a suspected data exfiltration. The analyst sees a large amount of data being sent to an external IP over HTTPS. The analyst also sees DNS queries for a domain that resolves to that IP. Which action would BEST help confirm the exfiltration?

Look for other connections to the same external IP in the pcap

Decrypt the HTTPS traffic using the server's private key or a man-in-the-middle proxy

Analyze the size of the HTTPS packets to estimate the amount of data

Check the DNS logs to see if other systems queried the same domain

What is the goal of the recovery phase in incident response?

To communicate with external stakeholders

To identify the root cause of the incident

To restore affected systems to normal operation

To collect evidence for legal proceedings

An incident responder is investigating a Windows workstation that is suspected of running malware. The malware is only present in memory and not on disk. The responder needs to identify the malicious process and its network connections. Which action should be taken FIRST?

Run a full antivirus scan on the system

Check the Windows event logs for suspicious entries

Capture the memory of the system using a tool like FTK Imager or DumpIt

Reboot the system to clear the malware from memory

An investigator is collecting evidence from a RAID server that is part of a database cluster. The server is still running and the database is in use. The investigator needs to preserve evidence without disrupting operations. Which approach is most appropriate?

Copy the database files to a USB drive using the operating system's copy command.

Image the RAID array using a hardware write-blocker while the server is running.

Shut down the server and remove the RAID drives for physical imaging.

Perform a logical acquisition of the database files and document the live state, rather than a physical image of the entire RAID.

EC-CouncilCertified Network Defender

Domain 6Objective 1

Incident Response and Forensics Investigation CND Practice Questions (Page 8)

Part of the Incident Response, Forensics and Continuity domain, which makes up ~13% of our current practice bank.

66questions here

14free pages

15concepts

15 Concepts in This Objective

Incident Response Fundamentals
Incident Response Phases
Incident Response Team Roles
Incident Classification and Triage
Evidence Collection and Preservation
Forensic Imaging and Duplication
Forensic Analysis Techniques
Log Analysis and Correlation
Memory and Volatile Data Analysis
Network Forensics
Malware Analysis Basics
Forensic Reporting and Documentation
Legal and Ethical Considerations
Incident Recovery and Remediation
Lessons Learned and Post-Incident Review

Questions 36–40

36foundation · easy
What is the primary purpose of a post-incident review (lessons learned)?
Select an answer first
37expert · hard
A network forensic analyst is examining a pcap file from a suspected data exfiltration. The analyst sees a large amount of data being sent to an external IP over HTTPS. The analyst also sees DNS queries for a domain that resolves to that IP. Which action would BEST help confirm the exfiltration?
Select an answer first
38foundation · easy
What is the goal of the recovery phase in incident response?
Select an answer first
39application · medium
An incident responder is investigating a Windows workstation that is suspected of running malware. The malware is only present in memory and not on disk. The responder needs to identify the malicious process and its network connections. Which action should be taken FIRST?
Select an answer first
40expert · hard
An investigator is collecting evidence from a RAID server that is part of a database cluster. The server is still running and the database is in use. The investigator needs to preserve evidence without disrupting operations. Which approach is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CND

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CND” is a trademark of its owner, used for identification only.