Incident Response and Forensics Investigation CND Practice Questions (Page 9)

Questions 41–45

1. 41expert · hard

   After a major incident, the IR team conducts a lessons-learned review. The team identifies that the incident detection was delayed because the SIEM alerts were not prioritized correctly. Which improvement would MOST directly address this issue?

   • ADisable low-priority alerts to reduce noise
   • BAssign more analysts to monitor the SIEM
   • CImplement a triage process that prioritizes alerts based on severity and potential impact
   • DIncrease the number of SIEM alerts to capture more events
   Reveal Solution Discussion Select an answer first
2. 42application · easy

   After a major security incident, the incident response team completes the recovery phase. Which activity should be performed to improve future response efforts?

   • AConduct a post-incident review to identify what worked and what needs improvement.
   • BDelete all logs related to the incident to free up storage space.
   • CImmediately implement all possible security controls without analysis.
   • DDisband the incident response team to reduce overhead.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a key ethical consideration when handling personal data during a forensic investigation?

   • ASharing all collected data with law enforcement
   • BMinimizing the collection of personal data to only what is necessary
   • CUsing personal data for any purpose that aids the investigation
   • DDeleting all personal data after the investigation
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   What is the primary purpose of network forensics?

   • ATo configure network devices securely
   • BTo inspect network traffic to trace attack paths and identify malicious communications
   • CTo block malicious traffic in real time
   • DTo monitor network performance
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A forensic analyst is examining a compromised Linux server. The memory dump shows a process named 'kworker' with a suspicious parent PID. The disk image shows a modified cron job that downloads a script from an external IP. The auth log shows a successful SSH login from an unknown IP at 3:00 AM. Which combination of findings best supports a conclusion that the server was compromised?

   • AThe process name 'kworker' is a standard Linux kernel thread, so it cannot be malicious.
   • BThe suspicious process, modified cron job, and SSH login from an unknown IP together indicate a persistent backdoor.
   • CThe modified cron job alone is sufficient to prove compromise.
   • DThe SSH login from an unknown IP is normal because SSH is allowed.
   Reveal Solution Discussion Select an answer first