Enterprise Environment Incident Response GCFA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which action is essential to maintain a proper chain of custody for digital evidence collected during an enterprise incident?

   • AMaking multiple copies of the evidence for analysis
   • BStoring the evidence on a network share for easy access
   • CDocumenting every person who handles the evidence and when
   • DEncrypting the evidence with a strong algorithm
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A global company experiences a ransomware attack that affects multiple business units in different countries. The IR team has activated the enterprise IR plan. Legal counsel in the EU has advised that GDPR notification may be required, while legal counsel in the US has advised that there may be SEC reporting obligations. The company's IR policy specifies that the IR team lead is the primary coordinator. What is the most appropriate first step for the IR team lead?

   • AConvene a conference call with legal counsel from all affected jurisdictions, the DPO, and the IR team to assess notification obligations and coordinate the response.
   • BImmediately notify the media to be transparent about the attack.
   • CSend a company-wide email to all employees with details of the attack.
   • DWait for the US legal counsel to decide before taking any action.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   How does the disaster recovery plan (DRP) differ from the incident response plan (IRP) in an enterprise?

   • AThe DRP focuses on restoring IT systems and infrastructure after a disaster, while the IRP focuses on containing and eradicating a security incident
   • BThe DRP is only activated during natural disasters, while the IRP is only activated during cyberattacks
   • CThe DRP is a subset of the IRP and contains the same steps
   • DThe DRP is developed by the business units, while the IRP is developed by the IT department
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   During a suspected data breach, the incident response team needs to preserve a compromised server's memory for later forensic analysis. The server is a production system that cannot be taken offline for more than a few minutes. Which action best balances forensic integrity with operational continuity?

   • APerform a live memory acquisition using a trusted forensic tool, then verify the hash of the acquired image.
   • BTake a screenshot of running processes and active network connections instead of a memory dump.
   • CPower off the server immediately and remove the hard drives for offline imaging.
   • DCopy the memory dump to a network share using the built-in Windows task manager.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A forensic analyst is collecting evidence from a compromised server. The analyst needs to ensure that the evidence will be admissible in court. Which practice is most important to follow?

   • AAnalyze the evidence immediately without documenting the process.
   • BStore the evidence on the analyst's personal laptop for convenience.
   • CUse a write blocker when imaging the hard drive.
   • DKeep the server powered on to preserve volatile memory.
   Reveal Solution Discussion Select an answer first