First Response ECIH Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   During first response, an incident handler collects a forensic image of a compromised laptop. The handler records the date, time, and hash values of the image in a log. What additional step is essential to maintain the chain of custody?

   • ADelete the original hard drive contents to prevent data leakage.
   • BDocument every person who handled the evidence and when.
   • CStore the image on the analyst's personal cloud drive for safekeeping.
   • DEmail the hash values to the legal team for verification.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A malware outbreak is spreading rapidly across a company's network. The incident handler must contain the outbreak, but the CEO insists on keeping the email server online because it is critical to business operations. The email server is suspected to be infected. What is the best containment strategy?

   • ABlock all outbound traffic from the email server.
   • BIsolate the email server from the rest of the network but allow it to continue sending and receiving email through a controlled relay.
   • CChange the email server's IP address and continue as normal.
   • DShut down the email server immediately to stop the spread.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   An incident responder is collecting evidence from a compromised system. They have taken a memory dump and are about to image the hard drive. What should they do BEFORE imaging the drive?

   • ADocument the system time and date.
   • BRecord the hash value of the memory dump.
   • CNotify the system owner that the system will be taken offline.
   • DVerify that the write blocker is properly connected.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A forensic analyst is called to a scene where a computer is still running and the screen shows an active chat session with an attacker. The analyst must preserve evidence. Which action is most appropriate?

   • APhotograph the screen, then capture memory and network connections.
   • BImmediately pull the power cord to freeze the system state.
   • CClose the chat window to prevent the attacker from seeing the analyst.
   • DDisconnect the network cable and then reboot the system.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During an incident, the incident response team discovers that the breach involves personally identifiable information (PII) of customers. According to the incident response plan, which stakeholders should be informed?

   • ALegal, management, and public relations, as specified in the plan.
   • BOnly the affected customers.
   • COnly the IT department.
   • DNo one outside the incident response team.
   Reveal Solution Discussion Select an answer first