12 Digital Forensics and Incident Response
Mini Quiz Answers

Question 1: A cybersecurity analyst in a corporation is now dealing with a security breach. The team is managing the incident response process using the CompTIA incident response lifecycle. The team has just completed the third step in the process. What must the team do next?

Question 1 Explanation: Preparation is the first phase, not the next step after analysis.

Detection is the second phase where alerts are identified and validated, which comes before analysis.

Analysis is the third phase involving scoping and impact assessment, which the team just completed.

Containment is the fourth phase where teams stop the attack by isolating systems, making it the correct next step after analysis.

Question 2: A large organization's cybersecurity incident response team receives an alert indicating potential threat actor activity on one of its servers. What should be the team's immediate action based on the incident response lifecycle?

Question 2 Explanation: Waiting for more alerts delays response and allows threats to spread.

Immediately disconnecting the server is a containment action that should only occur after confirming the incident, because it risks data loss or operational damage.

Analyzing the alert and its context determines if a genuine incident has occurred, which is the correct immediate action following detection.

Notifying the CEO first creates unnecessary delays in the response process.

Question 3: An organization's computer incident response team (CIRT) receives an alert that shows possible malicious activity on a critical server within the network, and they initiate the CompTIA incident response process. What order must the CIRT follow when performing the CompTIA incident response process?

Question 3 Explanation: Preparation, analysis, isolation, containment, recovery is incorrect because the events are in the wrong order.

Preparation, detection, analysis, containment, eradication, recovery follows the correct sequence of the CompTIA incident response lifecycle, which is different from other organizations' incident response lifecycles.

Detection, analysis, eradication, restoration, improvement is incorrect because eradication comes after containment, not immediately after analysis.

Isolation, analysis, restoration, eradication, improvement is incorrect because it starts with isolation rather than preparation and has the phases in the wrong order.

Question 4: The corporate network has been compromised by sophisticated attackers who have established persistence and may be monitoring email traffic and internal chat communications. The incident commander needs to coordinate the response team and share sensitive investigation details without alerting the intruders. What method of communication should be used?

Question 4 Explanation: Standard corporate email and internal messaging platforms should not be used because attackers may be monitoring these channels.

The corporate SIEM platform is for monitoring security events, not for team communications.

NetFlow analysis consoles analyze network traffic and do not function as communication tools.

Out-of-Band communications such as encrypted chat apps provide separate channels, preventing intruders from detecting the response activities.

Question 5: A SOC is overwhelmed with thousands of daily alerts, the vast majority of which are false positives generated by legitimate scripts. To improve operational efficiency and reduce analyst burnout, they need to refine alerts. What process BEST addresses this calibration?

Question 5 Explanation: Tuning SIEM thresholds refines the system to reduce false positives by adjusting detection rules.

Implementing SOAR automates responses but does not address the root cause of excessive false positives.

Conducting threat hunting campaigns searches for hidden threats but does not reduce alert volume.

Managing responder fatigue through shift rotation helps with human factors but does not fix the excessive alerts.

Question 6: Security analysts notice suspicious patterns of outbound connections from internal workstations to external IP addresses at regular fifteen-minute intervals, strongly suggesting command and control beaconing activity. They need to analyze these communication patterns and data volumes to identify compromised hosts, without storing full packet payloads due to bandwidth and storage constraints. Which technology provides this essential network metadata?

Question 6 Explanation: Full packet capture stores complete data packets which requires excessive bandwidth and storage, which is not suitable for the question's requirements.

NetFlow or IPFIX captures conversation patterns, timestamps, and metadata without storing full payloads, providing the necessary network information while conserving resources.

SIEM correlation rules do not specifically provide network flow metadata.

SOAR playbooks automate responses but do not capture network data.

Question 7: In digital forensics, why is the order of volatility significant during the data acquisition process?

Question 7 Explanation: The order of volatility does not determine whether data is legal.

The order of volatility does not directly impact whether evidence can be used in court.

The order of volatility ensures evidence from fragile sources like RAM gets collected before less fragile sources like disk drives, preventing loss of temporary data.

The order of volatility applies specifically to digital evidence, not physical crime scenes.

Question 8: What is the primary risk when using the live acquisition method during a cybersecurity investigation?

Question 8 Explanation: Live acquisition does capture volatile memory data from RAM, which is its purpose, so the first answer is wrong.

Live acquisition does not require physically unplugging the system; that describes static acquisition.

Live acquisition can alter data on the disk because running the system may modify files.

Live acquisition may alert the threat actor and allow time for anti-forensic actions because the system remains running and is potentially monitored by attackers.

Question 9: First responders arrive at the desk of a suspected compromised workstation and observe a USB drive connected to the system with a suspicious script actively running in the terminal window, along with an unrecognized wireless adapter plugged into the back of the computer. Before taking any action that might alter the system, they photograph the screen and carefully video record all connected devices. What is the reason for this?

Question 9 Explanation: Video recording does not prevent tampering; it only documents the status of the scene.

Video recording is not primarily a backup method for evidence files.

Video recording does not calculate replacement costs for workstations.

Video recording helps with integrity and proves the evidence originated directly from the crime scene by documenting the exact status before any changes occur.

Question 10: Security analysts working extended 12-hour shifts during a major ransomware incident are processing hundreds of low-priority informational alerts. This leads to tiredness, decreased attention to detail, slower response times, and missing critical indicators of lateral movement. What is this dangerous situation called?

Question 11: Investigators discover that prior to the attack, an adversary spent weeks researching employee names on LinkedIn and social media, scanning the company's public IP address ranges, and harvesting corporate email addresses from public sources to craft convincing spearphishing messages. Which stage of the Cyber Kill Chain does this information gathering represent?

Question 12: A CIRT needs to analyse thousands of files that form forensic evidence for a criminal case. Before doing this, they use software that checks which files are identical, and removes identical copies. This reduces the workload on the CIRT while preserving vital evidence. What is this process and how does it work?

Question 13: Rather than waiting for security alerts to trigger investigations, the security team assumes sophisticated attackers are already present in the network. They proactively search for hidden threats using behavioral analytics, hypothesis-driven investigation, and IOC sweeps without relying on automated tools. What describes this proactive security methodology?

Question 14: Which tool or concept used in cybersecurity monitoring gives a condensed overview of information from various data sources for daily incident response tasks?

Question 15: When creating a forensic copy of a suspect hard drive for laboratory analysis, the investigator attaches a hardware device between the source drive and the target workstation that prevents any accidental or automated editing of the original media. This ensures evidence integrity and admissibility. What essential forensic tool is being used?

Question 16: Which logs help detect any attempts made by a threat actor to attack a wireless network through disassociation events?

Question 17: A law enforcement agency arrives at a corporate office to seize servers suspected of containing evidence of financial crimes. Before imaging the drives, they must ensure they have proper legal authority to conduct the search, to prevent evidence from being excluded in court later. What legal concept is this?

Question 18: A corporation is notified that it is subject to legal action regarding a data breach. The legal team issues instructions to all employees to preserve any documents, emails, and data related to the incident. It forbids any deletion of potentially relevant information. What is this preservation order called?

Question 19: A forensic investigator transports a seized laptop from the crime scene to the forensic laboratory, then passes it to a technician for imaging. The technician then gives the laptop to an officer in a storage facility. At each transfer, they document the date, time, location, and identity of everyone who handled the evidence. What is this form of documentation?

Question 20: Investigators seize smartphones suspected of containing evidence of crimes. However, they fear the suspects may remotely wipe the devices via cellular signals or Wi-Fi once they realize the phones are compromised. They place the devices in specialized containers that block all Radio Frequency signals during transport to the forensic lab. What preservation tool prevents remote destruction of digital evidence?