Incident Response Process CSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the main advantage of using a write blocker when acquiring forensic data from a suspect's hard drive?

   • AIt encrypts the data during acquisition
   • BIt prevents any modification to the original drive
   • CIt increases the speed of the acquisition process
   • DIt allows the drive to be connected to any computer without drivers
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A SOC team is developing an incident response plan. They want to ensure that the plan is effective when a real incident occurs. Which activity is most important to include in the preparation phase?

   • AWait until an incident occurs to determine what is needed.
   • BPurchase the most expensive security tools available.
   • CDocument the incident response plan and store it in a secure location without testing it.
   • DConduct regular tabletop exercises and update the plan based on lessons learned.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During an incident response, an analyst needs to collect evidence from a compromised Linux server. The server is still running, and the analyst wants to preserve the evidence for potential legal action. Which action should the analyst take FIRST?

   • APower off the system immediately to prevent further damage
   • BCapture a memory dump using a tool like LiME before touching the disk
   • CRun a series of commands to gather system information and save the output
   • DCreate a forensic image of the hard drive using dd
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company uses a cloud-based email service and suspects that a compromised account was used to send phishing emails. The company needs to preserve evidence for a legal investigation. Which action is most appropriate?

   • APlace a legal hold on the mailbox and export the relevant emails and metadata using the cloud provider's eDiscovery tools.
   • BTake a full forensic image of the cloud provider's data center hard drives.
   • CAsk the cloud provider to physically seize the server hosting the mailbox.
   • DLog into the account and delete all emails to prevent further damage.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has suffered a ransomware attack. The incident response team has contained the spread and eradicated the malware. The team now needs to recover systems. Which recovery action should be taken FIRST?

   • APower on all systems and let them update automatically
   • BRestore the most critical systems from clean backups and verify their integrity
   • CRestore systems from the most recent backup, even if it is known to be infected
   • DReconnect all systems to the network simultaneously
   Reveal Solution Discussion Select an answer first