A security analyst is investigating a phishing campaign that targeted employees. The analyst needs to identify which employees clicked the malicious link. Which data source would provide the most direct evidence?

Employee interviews asking who clicked the link.

Web proxy logs showing visits to the malicious URL.

Email gateway logs showing the phishing emails sent to each employee.

Antivirus alerts on employee workstations.

A forensic team is responding to a security incident at a remote office. The team needs to collect evidence from several computers, but the office has limited power and network connectivity. The team must prioritize which evidence to collect first. Which evidence should be collected first?

Volatile data from running systems, such as memory and network connections.

Network logs from the office's router.

Hard drives from all computers.

Employee statements about the incident.

Which step is the first in the digital forensics process when handling a seized computer?

Acquire a forensic image of the storage media

A forensic examiner is investigating a case involving a suspect who used a cloud storage service to share illegal files. The examiner needs to preserve evidence from the cloud service. Which approach is most likely to yield admissible evidence?

Use a forensic tool to access the cloud service directly.

Log into the suspect's account using credentials found on their computer.

Ask the cloud provider to voluntarily provide the data.

Obtain a court order or subpoena for the cloud provider to preserve and produce the relevant data.

Certified Information Systems Security Professional

Domain 7Objective 1

7.1 - Understand and Comply with Investigations CISSP Practice Questions (Page 5)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

13%of the exam

Questions 21–25

21application · medium
A security analyst is investigating a phishing campaign that targeted employees. The analyst needs to identify which employees clicked the malicious link. Which data source would provide the most direct evidence?
Select an answer first
22expert · hard
A forensic team is responding to a security incident at a remote office. The team needs to collect evidence from several computers, but the office has limited power and network connectivity. The team must prioritize which evidence to collect first. Which evidence should be collected first?
Select an answer first
23foundation · easy
Which step is the first in the digital forensics process when handling a seized computer?
Select an answer first
24foundation · easy
Which type of digital artifact is most likely to provide evidence of a user's physical location at a specific time?
Select an answer first
25expert · hard
A forensic examiner is investigating a case involving a suspect who used a cloud storage service to share illegal files. The examiner needs to preserve evidence from the cloud service. Which approach is most likely to yield admissible evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.