Post incident Activities & Investigation questions with
accurate answers
A forensic team was commissioned to perform an analysis of
unrecognized processes running on a desktop personal computer. The
lead investigator advised the team against disconnecting the power in
order to:
prevent disk corruption.
conduct a hot-swap of the main disk drive.
avoid loss of data in server logs.
avoid loss of data stored in volatile memory. Ans✓✓✓D is the correct
answer.
Justification
Preventing disk corruption does not address the capture of the data that
exist in volatile memory.
Conducting a hot-swap of the main disk drive does not address the
capture of the data that exist in volatile memory.
,Avoiding loss of data in server logs does not address the capture of the
data that exist in volatile memory.
Disconnecting power from a system results in loss of data stored in
volatile memory. Those data could be vital for the investigation and for
understanding the extent of the impact of the event. Disconnecting
power is not recommended where analysis of running processes or the
content of volatile memory is required.
A root kit was used to capture detailed accounts receivable information.
What is the next step to ensure admissibility of evidence from a legal
standpoint, once the incident has been identified and the server isolated?
Document how the attack occurred.
Notify law enforcement.
Take an image copy of the media.
Close the accounts receivable system. Ans✓✓✓C is the correct answer.
Justification
Documentation is subsequent to taking an image copy and may be
supplementary.
,Notifying law enforcement is subsequent to taking an image copy,
preserving evidence and maintaining the chain of custody.
Taking an image copy of the media along with preserving any other
evidence and maintaining the chain of custody is a recommended
practice to ensure legal admissibility.
Closing the accounts receivable system is not a practical solution.
A security operations center detected an attempted structured query
language injection, but could not determine if it was successful. Which
of the following resources should the information security manager
approach to assess the possible impact?
Application support team
Business process owner
Network management team
System administrator Ans✓✓✓A is the correct answer.
Justification
, Structured query language (SQL) injection is an application-based
attack. Since the security operations center has detected an attempt of
SQL injection and could not determine if it was successful, the
information security manager should approach the application support
group that has access to data in order to identify the impact.
The business process owner may help the application support group
determine the overall impact, once it has been determined if the attack
has been successful.
Because SQL injection is an application-based attack, the network
management team is not the best resource to assess the possible impact.
The system administrator is not the best resource to assess the possible
impact. However, he or she may assist the application support team and
assist with incident response activities, should the attack have been
successful.
A virus incident has been reported and eradicated. The information
security manager is MOST interested in knowing the:
intrusion detection system configuration.
type and payload of the virus.
virus entry path.
accurate answers
A forensic team was commissioned to perform an analysis of
unrecognized processes running on a desktop personal computer. The
lead investigator advised the team against disconnecting the power in
order to:
prevent disk corruption.
conduct a hot-swap of the main disk drive.
avoid loss of data in server logs.
avoid loss of data stored in volatile memory. Ans✓✓✓D is the correct
answer.
Justification
Preventing disk corruption does not address the capture of the data that
exist in volatile memory.
Conducting a hot-swap of the main disk drive does not address the
capture of the data that exist in volatile memory.
,Avoiding loss of data in server logs does not address the capture of the
data that exist in volatile memory.
Disconnecting power from a system results in loss of data stored in
volatile memory. Those data could be vital for the investigation and for
understanding the extent of the impact of the event. Disconnecting
power is not recommended where analysis of running processes or the
content of volatile memory is required.
A root kit was used to capture detailed accounts receivable information.
What is the next step to ensure admissibility of evidence from a legal
standpoint, once the incident has been identified and the server isolated?
Document how the attack occurred.
Notify law enforcement.
Take an image copy of the media.
Close the accounts receivable system. Ans✓✓✓C is the correct answer.
Justification
Documentation is subsequent to taking an image copy and may be
supplementary.
,Notifying law enforcement is subsequent to taking an image copy,
preserving evidence and maintaining the chain of custody.
Taking an image copy of the media along with preserving any other
evidence and maintaining the chain of custody is a recommended
practice to ensure legal admissibility.
Closing the accounts receivable system is not a practical solution.
A security operations center detected an attempted structured query
language injection, but could not determine if it was successful. Which
of the following resources should the information security manager
approach to assess the possible impact?
Application support team
Business process owner
Network management team
System administrator Ans✓✓✓A is the correct answer.
Justification
, Structured query language (SQL) injection is an application-based
attack. Since the security operations center has detected an attempt of
SQL injection and could not determine if it was successful, the
information security manager should approach the application support
group that has access to data in order to identify the impact.
The business process owner may help the application support group
determine the overall impact, once it has been determined if the attack
has been successful.
Because SQL injection is an application-based attack, the network
management team is not the best resource to assess the possible impact.
The system administrator is not the best resource to assess the possible
impact. However, he or she may assist the application support team and
assist with incident response activities, should the attack have been
successful.
A virus incident has been reported and eradicated. The information
security manager is MOST interested in knowing the:
intrusion detection system configuration.
type and payload of the virus.
virus entry path.
