7.1 - Understand and Comply with Investigations CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an internal investigation, an investigator collects emails and chat logs from a suspected policy violation. The investigator must document the evidence for potential legal review. What is the most important element to include in the documentation?

   • AA summary of the investigation's conclusions and recommendations.
   • BA detailed chain of custody log for each piece of evidence.
   • CA list of all employees who have access to the email system.
   • DA copy of the company's acceptable use policy.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An organization is investigating a data breach that may involve an employee who works remotely. The employee's company-issued laptop is at their home. The investigation requires collecting evidence from the laptop, but the employee is uncooperative. The organization has a legal right to seize the laptop. What is the most appropriate action?

   • ARemotely wipe the laptop to prevent further data loss.
   • BCoordinate with law enforcement to execute a lawful seizure of the laptop.
   • CAsk the employee to mail the laptop to the office.
   • DDisable the employee's network access and monitor their activity.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During an investigation, an employee admits to sharing confidential files. The investigator wants to preserve the employee's statement as evidence. What is the most appropriate way to document the admission?

   • ADo not document the admission to protect the employee's privacy.
   • BWrite a summary of the conversation from memory after the interview.
   • CRecord the interview with the employee's consent and have the employee sign a written summary.
   • DAsk the employee to send an email confirming the admission.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A forensic examiner is investigating a suspected data exfiltration. The examiner has a forensic image of the suspect's laptop. Which step is most important to perform before analyzing the image?

   • AVerify the integrity of the image by comparing its hash to the original drive's hash.
   • BBoot the image in a virtual machine to see the system state.
   • CRun a malware scan on the image.
   • DCopy the image to multiple backup drives.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A forensic analyst is examining a network server that was compromised. The analyst needs to preserve evidence of the attacker's activities. Which type of evidence is most volatile and should be collected first?

   • AFiles stored on the hard drive.
   • BThe system's configuration files.
   • CNetwork connections and active processes.
   • DSystem logs stored on disk.
   Reveal Solution Discussion Select an answer first