Incident response and management - 3
100. While reviewing the actions taken during an incident response process , Mei is informed by the local desktop support staff person that the infected machine was returned to service by using a Windows System Restore point . Which of the following items will a Windows System Restore return to a previous state ? A. Personal files B. Malware C. Windows system files D. All installed apps
A
101. During a major incident response effort , Kobe discovers evidence that a critical application server may have been the data repository and egress point in the compromise he is investigating . If he is unable to take the system offline , which of the following options will provide him with the best forensic data ? A. Reboot the server and mount the system drive using a USB - bootable forensic suite . B. Create an image using a tool like FTK Imager Lite . C. Capture the system memory using a tool like Volatility . D. Install and run an imaging tool on the live server .
A
104. During the preparation phase of his organization's incident response process , Oscar gathers a laptop with useful software including a sniffer and forensics tools , thumb drives and external hard drives , networking equipment , and a variety of cables . What is this type of preprepared equipment commonly called ? A. A grab bag B. A jump kit C. A crash cart D. A first responder kit
A
105. As John proceeds with a forensic investigation involving numerous images , he finds a directory labeled Downloaded from Facebook . The images appear relevant to his investigation , so he processes them for metadata using exiftool . The following image shows the data provided . What forensically useful information can John gather from this output
A
106. Which of the following properly lists the order of volatility from least to most volatile ? A. Printouts , swap files , CPU cache , RAM B. Hard drives , USB media , DVDs , CD - RWS C. DVDs , hard drives , virtual memory , caches D. RAM , swap files , SSDs , printouts
A
107. While conducting a forensic review of a system involved in a data breach , Alex discovers a number of Microsoft Word files including files with filenames like critical_data.docx and sales_estimates_2023.docx . When he attempts to review the files using a text editor for any useful information , he finds only unreadable data . What has occurred ? A. Microsoft Word files are stored in ZIP format . B. Microsoft Word files are encrypted . C. Microsoft Word files can be opened only by Microsoft Word . D. The user has used antiforensic techniques to scramble the data .
A
108. Lukas believes that one of his users has attempted to use built - in Windows commands to probe servers on the network he is responsible for . How can he recover the command history for that user if the system has been rebooted since the reconnaissance has occurred ? A. Check the Bash history . B. Open a command prompt window and press F7 . C. Manually open the command history from the user's profile directory . D. The Windows command prompt does not store command history .
A
109. Angela is conducting an incident response exercise and needs to assess the economic impact on her organization of a $ 500,000 expense related to an information security incident . How should she categorize this ? A. Low impact . B. Medium impact . C. High impact . D. Angela cannot assess the impact with the data given .
A
110. What step follows sanitization of media according to NIST guidelines for secure media handling ? A. Reuse . B. Validation C. Destruction . D.Documentation .
A
111. Latisha wants to create a documented chain of custody for the systems that she is handling as part of a forensic investigation . Which of the following will provide her with evidence that systems were not tampered with while she is not working with them ? A. A chain of custody log B. Tamper - proof seals C. System logs D. None of the above
A
112. Matt's incident response team has collected log information and is working on identifying attackers using that information . What two stages of the NIST incident response process is his team working in ? A. Preparation and containment , eradication , and recovery B. Preparation and post - incident activity C. Detection and analysis , and containment , eradication , and recovery D. Containment , eradication , and recovery and post - incident activity
A
113. Raj discovers that the forensic image he has attempted to create has failed . What is the most likely reason for this failure ? A. Data was modified . B. The source disk is encrypted . C. The destination disk has bad sectors . D. The data cannot be copied in RAW format .
A
115. Which of the following activities is not part of the containment and restoration process ? A. Minimizing loss B. Identifying the attacker C. Limiting service disruption D. Rebuilding compromised systems
A
116. Samantha has recently taken a new position as the first staff security analyst that her employer has ever had . During her first week , she discovers that there is no information security policy and that the IT staff do not know what to do during a security incident . Samantha plans to start up a CSIRT to handle incident response . What type of documentation should she provide to describe specific procedures that the CSIRT will use during events like malware infections and server compromise ? A. An incident response policy B. An operations manual C. An incident response program D. A playbook
A
117. What is space between the last sector containing logical data and the end of the cluster called ? A. Unallocated space B. Ephemeral space C. Slack space D. Unformatted space
A
118. Jack is preparing to take a currently running PC back to his forensic lab for analysis . As Jack considers his forensic process , one of his peers recommends that he simply unplug the power cable rather than doing a software - based shutdown . Why might Jack choose to follow this advice ? A. It will create a crash log , providing useful memory forensic information . B. It will prevent shutdown scripts from running . C. It will create a memory dump , providing useful forensic information . D. It will cause memory - resident malware to be captured , allowing analysis .
A
119. Rick wants to validate his recovery efforts and intends to scan a web server he is responsible for with a scanning tool . What tool should he use to get the most useful information about system vulnerabilities ? A. Wapiti B. Nmap C. OpenVAS D. ZAP
A
120. What is the key goal of the containment stage of an incident response process ? A. To limit leaks to the press or customers B. To limit further damage from occurring C. To prevent data exfiltration D. To restore systems to normal operation
A
121. What level of forensic data extraction will most likely be possible and reasonable for a corporate forensic examiner who deals with modern phones that provide filesystem encryption ? A. Level 1 : Manual extraction B. Level 2 : Logical extraction C. Level 3 : JTAG or HEX dumping D. Level 4 : Chip extraction
A
122. Wang believes that a Windows system he is responsible for is compromised and wants to monitor traffic to and from it . Which of the following is not a typical capture option in circumstances like these ? A. A packet capture tool installed on the system B. A packet capture tool on another system on the same network C. Packet capture at the network edge D. Packet capture at the network core
A
124. During an e - discovery process , Carol reviews the request from opposing counsel and builds a list of all the individuals identified . She then contacts the IT staff who support each person to request a list of their IT assets . What phase of the EDRM flow is she in ? A. Information governance B. Identification C. Preservation D. Collection
A
125. During the preservation phase of her work , Carol discovers that information requested as part of the discovery request has been deleted as part of a regularly scheduled data cleanup as required by her organization's policies . What should Carol do ? A. Conduct a forensic recovery of the data . B. Create synthetic data to replace the missing data . C. Report the issue to counsel . D. Purge any other data related to the request based on the same policy .
A
14. Rowan wants to block drive - by - downloads and bot command and - control channels while redirecting potentially impacted systems to a warning message . What should she implement to do this ? A. A DNS sinkhole B. A WAF C. An IDS D. A UEBA
A
18. Melissa is using the US - CERT's scale to measure the impact of the location of observed activity by a threat actor . Which of the following should be the highest rated threat activity location ? A. Critical system screened subnet ( DMZ ) B. Business network C. Business screened subnet ( DMZ ) D. Safety systems
A
19. Derek's organization has been working to recover from a recent malware infection that caused outages across the organization during an important part of their business cycle . To properly triage , what should Derek pay the most attention to first ? A. The immediate impact on operations so that his team can restore functionality B. The total impact of the event so that his team can provide an accurate final report C. The immediate impact on operations so that his team can identify the likely threat actor D. The total impact of the event so that his team can build a new threat model for future use
A
2. As part of an organization - wide red team exercise , Frank is able to use a known vulnerability to compromise an Apache web server . Frank knows that the Apache service is running under a limited user account . Once he has gained access , what should his next step be if he wants to use the system to pivot to protected systems behind the screened subnet ( DMZ ) that the web server resides in ? A. Vulnerability scanning B. Privilege escalation C. Patching D. Installing additional tools
A
20. Jeff discovers multiple JPEG photos during his forensic investigation of a computer involved in an incident . When he runs exiftool to gather file metadata , which information is not likely to be part of the images even if they have complete metadata intact ? A. GPS location B. Camera type C. Number of copies made D. Correct date / timestamp
A
22. The organization that Jamal works for classifies security related events using NIST's standard definitions . Which classification should he use when he discovers key logging software on one of his frequent business travelers ' laptop ? A. An event B. An adverse event C. A security incident . D. A policy violation
A
23. Dan is designing a segmented network that places systems with different levels of security requirements into different subnets with firewalls and other network security devices between them . What phase of the incident response process is Dan in ? A. Post - incident activity B. Detection and analysis C. Preparation D. Containment , eradication , and recovery
A
24. Lauren wants to create a backup of Linux permissions before making changes to the Linux workstation she is attempting to remediate . What Linux tool can she use to back up the permissions of an entire directory on the system ? A. She can use chbkup . B. She can use get facl . She can use aclman . D. There is not a common Linux permission backup tool .
A
25. While working to restore systems to their original configuration after a long - term APT compromise , Manish has three options . A. He can restore from a backup and then update patches on the system . B. He can rebuild and patch the system using original installation media and application software using his organization's build documentation . C. He can remove the compromised accounts and rootkit tools and then fix the issues that allowed the attackers to access the systems . C. He can remove the compromised accounts and rootkit tools and then fix the issues that allowed the attackers to access the systems . Which option should Manish choose in this scenario ? A. Option A. B. Option B. C. Option C. D. None of the above . Manish should hire a third party to assess the systems before proceeding .
A
26. Jessica wants to access a macOS FileVault 2 - encrypted drive . Which of the following methods is not a possible means of unlocking the volume ? A. Change the FileVault key using a trusted user account . B. Retrieve the key from memory while the volume is mounted . C. Acquire the recovery key . D. Extract the keys from iCloud .
A
26. Jessica wants to access a macOS FileVault 2 - encrypted drive . Which of the following methods is not a possible means of unlocking the volume ? A. Change the FileVault key using a trusted user account B. Retrieve the key from memory while the volume is mounted . C. Acquire the recovery key . D. Extract the keys from iCloud .
A
28. If Suki wants to purge a drive , which of the following options will accomplish her goal ? A. Cryptographic erase B. Reformat C. Overwrite D. Repartition
A
29. While performing post - rebuild validation efforts , Scott scans a server from a remote network and sees no vulnerabilities . Joanna , the administrator of the machine , runs a scan and discovers two critical vulnerabilities and five moderate issues . What is most likely causing the difference in their reports ? A. Different patch levels were used during the scans . B. They are scanning through a load balancer . C. There is a firewall between the remote network and the server . D. Scott or Joanna ran the vulnerability scan with different settings .
A
3. Helen is using the Lockheed Martin Cyber Kill Chain to analyze an attack that took place against her organization . During the attack , the perpetrator attached a malicious tool to an email message that was sent to the victim . What phase of the Cyber Kill Chain includes this type of activity ? A. Weaponization B. Delivery C. Exploitation D. Actions on objectives
A
30. As part of his organization's cooperation in a large criminal case , Adam's forensic team has been asked to send a forensic image of a highly sensitive compromised system in RAW format to an external forensic examiner . What steps should Adam's team take prior to sending a drive containing the forensic image ? A. Encode in EO1 format and provide a hash of the original file on the drive . B. Encode in FTK format and provide a hash of the new file on the drive . C. Encrypt the RAW file and transfer a hash and key under separate cover . D. Decrypt the RAW file and transfer a hash under separate cover .
A
31. Mika wants to analyze the contents of a drive without causing any changes to the drive . What method is best suited to ensuring this ? A. Set the " read - only " jumper on the drive . B. Use a write blocker . C. Use a read blocker . D. Use a forensic software package .
A
33. James wants to determine whether other Windows systems on his network are infected with the same malware package that he has discovered on the workstation he is analyzing . He has removed the system from his network by unplugging its network cable , as required by corporate policy . He knows that the system has previously exhibited beaconing behavior and wants to use that behavior to identify other infected systems How can he safely create a fingerprint for this beaconing without modifying the infected system ? A. Plug the system into the network and capture the traffic quickly at the firewall using Wireshark or tcpdump . B. Plug the system into an isolated switch and use a span port or tap and Wireshark / tcpdump to capture traffic . C. Review the ARP cache for outbound traffic . D. Review the Windows Defender Firewall log for traffic logs .
A
34. After completing an incident response process and providing a final report to management , what step should Casey use to identify improvement to her incident response plan ? A. Update system documentation . B. Conduct a lessons learned session . C. Review patching status and vulnerability scans . D. Engage third - party consultants .
A
35. During a forensic investigation , Lukas discovers that he needs to capture a virtual machine that is part of the critical operations of his company's website . If he cannot suspend or shut down the machine for business reasons , what imaging process should he follow ? A. Perform a snapshot of the system , boot it , suspend the copied version , and copy the directory it resides in . B. Copy the virtual disk files and then use a memory capture tool . C. Escalate to management to get permission to suspend the system to allow a true forensic copy . D. Use a tool like the Volatility Framework to capture the live machine completely .
A
36. Mika , a computer forensic examiner , receives a PC and its . peripherals that were seized as forensic evidence during an investigation . After she signs off on the chain of custody log and starts to prepare for her investigation , one of the first things she notes is that each cable and port was labeled with a color - coded sticker by the onsite team . Why are the items labeled like this ? A. To ensure chain of custody B. To ensure correct reassembly C. To allow for easier documentation of acquisition D. To tamper - proof the system
A
38. Lakshman needs to sanitize hard drives that will be leaving his organization after a lease is over . The drives contained information that his organization classifies as sensitive data that competitors would find valuable if they could obtain Which choice is the most appropriate to ensure that data exposure does not occur during this process ? A. Clear , validate , and document . B. Purge the drives . C. Purge , validate , and document . D. The drives must be destroyed to ensure no data loss .
A
39. Selah is preparing to collect a forensic image for a Macintosh computer running the Ventura operating system . What hard drive format is she most likely to encounter ? A. FAT32 B. MacFAT C. APFS D. HFS +
A
4. Betty wants to review the security logs on her Windows workstation . What tool should she use to do this ? A. Secpol.msc B. Event Viewer C. Log Viewer D. Logview.msc
A
40. During a forensic analysis of an employee's computer as part of a human resources investigation into misuse of company resources , Tim discovers a program called Eraser installed on the PC . What should Tim expect to find as part of his investigation ? A. A wiped C : drive B. Antiforensic activities C. All slack space cleared D. Temporary files and Internet history wiped
A
41. Jessica wants to recover deleted files from slack space and needs to identify where the files begin and end . What is this process called ? A. Slacking B. Data carving C. Disk recovery D. Header manipulation
A
42. Latisha is the IT manager for a small company and occasionally serves as the organization's information security officer . Who would be the most appropriate leader for her organization's CSIRT ? A. Her lead IT support staff technician . B. Her organization's legal counsel . C. A third - party IR team lead . D. She should select herself .
A
44. Alex suspects that an attacker has modified a Linux executable using static libraries . Which of the following Linux commands is best suited to determining whether this has occurred ? A. file B. stat C. strings D. grep
A
45. Because of external factors , Eric has only a limited time period to collect an image from a workstation . If he collects only specific files of interest , what type of acquisition has he performed ? A. Logical B. Bit - by - bit C. Sparse D. None of the above
A
46. During a forensic investigation , Kwame records information . about each drive , including where it was acquired , who made the forensic copy , the MD5 hash of the drive , and other details . What term describes the process Kwame is using as he labels evidence with details of who acquired and validated it ? A. Direct evidence B. Circumstantial evidence C. Incident logging D. Chain of custody
A
47. Susan needs to perform forensics on a virtual machine . What process should she use to ensure she gets all of the forensic data she may need ? A. Suspend the machine and copy the contents of the directory it resides in . B. Perform a live image of the machine . C. Suspend the machine and make a forensic copy of the drive it resides on . D. Turn the virtual machine off and make a forensic copy of it .
A
48. Allison wants to access Chrome logs as part of a forensic investigation . What format is information about cookies , history , and saved form responses saved in ? A. SQLite B. Plain text C. Base64 - encoded text D. NoSQL
A
5. The ATT & CK framework defines which of the following as " the specifics behind how the adversary would attack the target ? " A. The threat actor B. The targeting method C. The attack vector D. The organizational weakness
A
50. Saanvi needs to validate the MD5 checksum of a file on a Windows system to ensure that there were no unauthorized changes to the binary file . He is not allowed to install any programs and cannot run files from external media or drives . What Windows utility can he use to get the MD5 hash of the file A. md5sum B. certutil C. shalsum D. hashcheck
A
51. Forensic investigation shows that the target of an investigation used the Windows Quick Format command to attempt to destroy evidence on a USB thumb drive . Which of the NIST sanitization techniques has the target of the investigation used in their attempt to conceal evidence ? A. Clear B. Purge C. Destroy D. None of the above
A
52. During an incident response process , Susan plugs a system back into the network , allowing it normal network access . What phase of the incident response process is Susan performing ? A. Preparation B. Detection and analysis C. Containment , eradication , and recovery D. Post - incident activity
A
53. Mei's team has completed the initial phases of their incident response process and is assessing the time required to recover from the incident . Using the NIST recoverability effort categories , the team has determined that they can predict the time to recover but will require additional resources . How should she categorize this using the NIST model ? A. Regular B. Supplemented C. Extended D. Not recoverable Janet is attempting
A
54. Janet is attempting to conceal her actions on a company owned computer . As part of her cleanup attempts , she deletes all the files she downloaded from a corporate file server using a browser in incognito mode . How can a forensic investigator determine what files she downloaded ? A. Network flows B. SMB logs C. Browser cache D. Drive analysis
A
55. Jose is aware that an attacker has compromised a system on his network but wants to continue to observe the attacker's efforts as they continue their attack . If Jose wants to prevent additional impact on his network while watching what the attacker does , what containment method should he use ? A. Removal B. Isolation C. Segmentation D. Detection
A
56. When Abdul arrived at work this morning , he found an email in his inbox that read , " Your systems are weak ; we will own your network by the end of the week . " How would he categorize this sign of a potential incident if he was using the NIST SP 800-61 descriptions of incident signs ? A. An indicator B. A threat C. A risk D. A precursor
A
57. During an incident response process , Cynthia conducts a lessons learned review . What phase of the incident response process is she in ? A. Preparation B. Detection and analysis C. Containment , eradication , and recovery D. Post - incident recovery
A
58. As part of his incident response program , Allan is designing a playbook for zero - day threats . Which of the following should not be in his plan to handle them ? A. Segmentation B. Patching C. Using threat intelligence D. Allow listing / whitelisting
A
59. As the CISO of her organization , Mei is working on an incident classification scheme and wants to base her design on NIST's definitions . Which of the following options should she use to best describe a user accessing a file that they are not authorized to view ? A. An incident B. An event C. An adverse event D. A security incident
A
6. Jamal wants to leverage a framework to improve his threat hunting for network defense . What threat - hunting framework should he select to help his team categorize and analyze threats more effectively ? A. MOPAR B. CVSS C. MITRE ATT & CK D. CAPEC
A
60. Fred wants to identify digital evidence that can place an individual in a specific place at a specific time . Which of the following types of digital forensic data is not commonly used to attempt to document physical location at specific times ? A. Cell phone GPS logs B. Photograph metadata C. Cell phone tower logs D. Microsoft Office document metadata
A
61. Kai has completed the validation process of her media sanitization efforts and has checked a sample of the drives she had purged using a built - in cryptographic wipe utility . What is her next step ? A. Resample to validate her testing . B. Destroy the drives . C. Create documentation . D. She is done and can send the drives on for disposition .
A
62. In his role as a small company's information security manager , Mike has a limited budget for hiring permanent staff . Although his team can handle simple virus infections , he does not currently have a way to handle significant information security incidents . Which of the following options should Mike investigate to ensure that his company is prepared for security incidents ? A. Outsource to a third - party SOC . B. Create an internal SOC . C. Hire an internal incident response team . D. Outsource to an incident response provider .
A
63. Bohai wants to ensure that media has been properly sanitized . Which of the following options properly lists sanitization descriptions from least to most effective ? A. Purge , clear , destroy B. Eliminate , eradicate , destroy C. Clear , purge , destroy D. Eradicate , eliminate , destroy
A
67. After arriving at an investigation site , Brian determines that three powered - on computers need to be taken for forensic examination . What steps should he take before removing the PCs ? A. Power them down , take pictures of how each is connected , and log each system in as evidence . B. Take photos of each system , power them down , and attach a tamper - evident seal to each PC . C. Collect live forensic information , take photos of each system , and power them down . D. Collect a static drive image , validate the hash of the image , and securely transport each system .
A
68. In his role as a forensic examiner , Lukas has been asked to produce forensic evidence related to a civil case . What is this process called ? A. Criminal forensics B. E - discovery C. Cyber production D. Civil tort
A
69. As Mika studies her company's computer forensics playbook , she notices that forensic investigators are required to use a chain of custody form . Which of the following best describes the information that she should record on that form if she was conducting a forensic investigation ? A. The list of individuals who made contact with files leading to the investigation B. The list of former owners or operators of the PC involved in the investigation C. All individuals who work with evidence in the investigation D. The police officers who take possession of the evidence
A
7. Maria is an Active Directory domain administrator for her company , and she knows that a quickly spreading botnet relies on a series of domain names for command and control and that preventing access to those domain names will cause the malware infection that connects to the botnet to fail to take further action . Which of the following actions is her best option if she wants to prevent offsite Windows users from connecting to botnet command - and - control systems ? A. Force a BGP update . B. Set up a DNS sinkhole . C. Modify the hosts file . D. Install an antimalware application .
A
70. Scott needs to ensure that the system he just rebuilt after an incident is secure . Which type of scan will provide him with the most useful information to meet his goal ? A. An authenticated vulnerability scan from a trusted internal network B. An unauthenticated vulnerability scan from a trusted internal network C. An authenticated scan from an untrusted external network D. An unauthenticated scan from an untrusted external network
A
71. What is the primary role of management in the incident . response process ? A. Leading the CSIRT B. Acting as the primary interface with law enforcement C. Providing authority and resources D. Assessing impact on stakeholders .
A
72. Max wants to improve the effectiveness of the incident analysis process he is responsible for as the leader of his organization's CSIRT . Which of the following is not a commonly recommended best practice based on NIST's guidelines ? A. Profile networks and systems to measure the characteristics of expected activity .B. Perform event correlation to combine information from multiple sources . C. Maintain backups of every system and device . D. Capture network traffic as soon as an incident is suspected .
A
73. NIST describes four major phases in the incident response cycle . Which of the following is not one of the four ? A. Containment , eradication , and recovery B. Notification and communication C. Detection and analysis D. Preparation
A
76. Ty needs to determine the proper retention policy for his organization's incident data . If he wants to follow common industry practices and does not have specific legal or contractual obligations that he needs to meet , what timeframe should he select ? A. 30 days B. 90 days C. 1 to 2 years D. 7 years
A
77. The system that Alice has identified as the source of beaconing traffic is one of her organization's critical e - commerce servers . To maintain her organization's operations , she needs to quickly restore the server to its original , uncompromised state . What criterion is likely to be impacted the most by this action ? A. Damage to the system or service B. Service availability C. Ability to preserve evidence D. Time and resources needed to implement the strategy
A
78. Piper wants to create a forensic image that third - party investigators can use but does not know what tool the third party investigation team that her company intends to engage will use . Which of the following forensic formats should she choose if she wants almost any forensic tool to be able to access the image ? A. E01 B. AFF C. RAW D. AD1
A
79. As part of his forensic investigation , Scott intends to make a forensic image of a network share that is mounted by the PC that is the focus of his investigation . What information will he be unable to capture ? A. File creation dates . B. Deleted files C. File permission data D. File metadata
A
8. While attempting to stop a rogue service , Monica issues the following Linux command on an Ubuntu system using upstart : service rogueservice stop After a reboot , she discovers the service running again . What happened , and what does she need to do to prevent this ? A. The service restarted at reboot , so she needs to include the -p , or permanent , flag . B. The service restarted itself , so she needs to delete the binary associated with the service . C. The service restarted at reboot , so she should add an .override file to stop the service from starting . D. A malicious user restarted the service , so she needs to ensure users cannot restart services .
A
80. What common incident response follow - up activity includes asking questions like " What additional tools or resources are needed to detect or analyze future events ? " A. Preparation B. Lessons learned review C. Evidence gathering D. Procedural analysis .
A
81. Suki has been asked to capture forensic data from a Windows PC and needs to ensure that she captures the data in their order of volatility . Which order is correct from most to least volatile ? A. Network traffic , CPU cache , disk drives , optical media B. CPU cache , network traffic , disk drives , optical media C. Optical media , disk drives , network traffic , CPU cache D. Network traffic , CPU cache , optical media , disk drives
A
82. During an incident response process , Suki heads to a compromised system and disconnects its network cable . What phase of the incident response process is Suki performing ? A. Preparation B. Detection and analysis C. Containment , eradication , and recovery D. Post - incident activity
A
83. Scott needs to verify that the forensic image he has created is an exact duplicate of the original drive . Which of the following methods is considered forensically sound ? A. Create a MD5 hash B. Create a SHA - 1 hash C. Create a SHA - 2 hash D. All of the above
A
84. What strategy does NIST suggest for identifying attackers during an incident response process ? A. Use geographic IP tracking to identify the attacker's location . B. Contact upstream ISPs for assistance in tracking down the attacker . C. Contact local law enforcement so that they can use law enforcement - specific tools . D. Identifying attackers is not an important part of the incident response process .
A
85. While performing forensic analysis of an iPhone backup , Cynthia discovers that she has only some of the information that she expects the phone to contain . What is the most likely scenario that would result in the backup she is using having partial information ? A. The backup was interrupted . B. The backup is encrypted . C. The backup is a differential backup . D. The backup is stored in iCloud .
A
86. Cullen wants to ensure that his chain of custody documentation will stand up to examination in court . Which of the following options will provide him with the best documentary proof of his actions ? A. A second examiner acting as a witness and countersigning all actions B. A complete forensic logbook signed and sealed by a notary public C. A documented forensic process with required sign - off D. Taking pictures of all independent forensic actions
A
89. Kathleen is restoring a critical business system to operation after a major compromise and needs to validate that the operating system and application files are legitimate and do not have any malicious code included in them . What type of tool should she use to validate this ? A. A trusted system binary kit B. Dynamic code analysis C. Static code analysis . D. File rainbow tables
A
90. Mel is creating the evidence log for a computer that was part of an attack on an external third - party system . What network related information should he include in that log if he wants to follow NIST's recommendations ? A. Subnet mask , DHCP server , hostname , MAC address B. IP addresses , MAC addresses , hostname C. Domain , hostname , MAC addresses , IP addresses D. NIC manufacturer , MAC addresses , IP addresses , DHCP configuration
A
91. Ryan believes that systems on his network have been compromised by an advanced persistent threat actor . He has observed a number of large file transfers outbound to remote sites via TLS - protected HTTP sessions from systems that do not typically send data to those locations . Which of the following techniques is most likely to detect the APT infections ? A. Network traffic analysis B. Network forensics . C. Endpoint behavior analysis D. Endpoint forensics
A
92. Ben is investigating a potential malware infection of a laptop belonging to a senior manager in the company he works for . When the manager opens a document , website , or other application that takes user input , words start to appear as though they are being typed . What is the first step that Ben should take in his investigation ? A. Run an antivirus scan . B. Disconnect the system from the network . C. Wipe the system and reinstall . D. Observe and record what is being typed .
A
93. Kathleen's forensic analysis of a laptop that is believed to have been used to access sensitive corporate data shows that the suspect tried to overwrite the data they downloaded as part of antiforensic activities by deleting the original files and then copying other files to the drive . Where is Kathleen most likely to find evidence of the original files ? A. The MBR B. Unallocated space C. Slack space D. The FAT
A
96. As an employee of the U.S. government , Megan is required to use NIST's information impact categories to classify security incidents . During a recent incident , proprietary information was changed . How should she classify this incident ? A. As a privacy breach B. As an integrity loss C. As a proprietary breach D. As an availability breach
A
97. During what stage of an event is preservation of evidence typically handled ? A. Preparation B. Detection and analysis . C. Containment , eradication , and recovery D. Post - incident activity
A
98. Lukas wants to purge a drive to ensure that data cannot be extracted when it is sent offsite . Which of the following is not a valid option for purging hard drives on a Windows system ? A. Use the built - in Windows sdelete command line . B. Use Eraser . C. Use DBAN . D. Encrypt the drive and then delete the key .
A
99. Which of the following is not a valid use case for live forensic imaging ? A. Malware analysis B. Encrypted drives C. Postmortem forensics D. Nonsupported filesystems
A
