Chapter 3 Domain 3.0: Incident Response and Management
Consider the threat modeling analysis shown here. What attack framework was used to develop this analysis?
ATT&CK
Cyber Kill Chain
STRIDE
Diamond
As part of an organization-wide red team exercise, Frank is able to use a known vulnerability to compromise an Apache web server. Frank knows that the Apache service is running under a limited user account. Once he has gained access, what should his next step be if he wants to use the system to pivot to protected systems behind the screened subnet (DMZ) that the web server resides in?
Vulnerability scanning
Privilege escalation
Patching
Installing additional tools
Helen is using the Lockheed Martin Cyber Kill Chain to analyze an attack that took place against her organization. During the attack, the perpetrator attached a malicious tool to an email message that was sent to the victim. What phase of the Cyber Kill Chain includes this type of activity?
Weaponization
Delivery
Exploitation
Actions on objectives
Betty wants to review the security logs on her Windows workstation. What tool should she use to do this?
Secpol.msc
Event Viewer
Log Viewer
Logview.msc
The ATT&CK framework defines which of the following as “the specifics behind how the adversary would attack the target?”
The threat actor
The targeting method
The attack vector
The organizational weakness
Jamal wants to leverage a framework to improve his threat hunting for network defense. What threat-hunting framework should he select to help his team categorize and analyze threats more effectively?
MOPAR
CVSS
MITRE ATT&CK
CAPEC
Maria is an Active Directory domain administrator for her company, and she knows that a quickly spreading botnet relies on a series of domain names for command and control and that preventing access to those domain names will cause the malware infection that connects to the botnet to fail to take further action. Which of the following actions is her best option if she wants to prevent offsite Windows users from connecting to botnet command-and-control systems?
Force a BGP update.
Set up a DNS sinkhole.
Modify the hosts file.
Install an antimalware application.
While attempting to stop a rogue service, Monica issues the following Linux command on an Ubuntu system using upstart:
service rogueservice stop
After a reboot, she discovers the service running again. What happened, and what does she need to do to prevent this?
The service restarted at reboot, so she needs to include the -p, or permanent, flag.
The service restarted itself, so she needs to delete the binary associated with the service.
The service restarted at reboot, so she should add an .override file to stop the service from starting.
A malicious user restarted the service, so she needs to ensure users cannot restart services.
Questions 9–12 refer to the following scenario and image.
Bill is reviewing the authentication logs for a Linux system that he operates and encounters the following log entries:
Aug 30 09:46:54 ip-172-30-0-62 sshd[3051]: Accepted publickey for ec2-user from 10.174.238.88 port 57478 ssh2: RSA e5:f5:c1:46:bb:49:a1:43:da:9d:50:c5:37:bd:79:22Aug 30 09:46:54 ip-172-30-0-62 ssh[3051]: pam_unix[sshd:session]: session opened for user ec2-user by (uid=0)Aug 30 09:48:06 ip-172-30-0-62 sudo: ec2-user : TTY=ps/0 ; PWD=/home/ec2-user ; USER=root; COMMAND=/bin/bash
What is the IP address of the system where the user was logged in when they initiated the connection?
172.30.0.62
62.0.30.172
10.174.238.88
9.48.6.0
What service did the user use to connect to the server?
HTTPS
PTS
SSH
Telnet
What authentication technique did the user use to connect to the server?
Password
PKI
Token
Biometric
What account did the individual use to connect to the server?
root
ec2-user
bash
pam_unix
Alaina adds the openphish URL list to her SOAR tool and sees the following entries:
What action should she take based on phishing URLs like these?
Block the IP address at her border firewall.
Monitor for the IP address using her IDS.
Delete emails with the URL from inbound email.
Nothing, as these have not been confirmed.
Rowan wants to block drive-by-downloads and bot command-and-control channels while redirecting potentially impacted systems to a warning message. What should she implement to do this?
A DNS sinkhole
A WAF
An IDS
A UEBA
Use the following table and rating information for questions 15–17.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) uses a 1–100 scale for incident prioritization, with weight assigned to each of a number of categories. The functional impact score is weighted in their demonstration as follows:
Functional Impact
Rating
No impact
0
No impact to services
20
Minimal impact to noncritical services
35
Minimal impact to critical services
40
Significant impact to noncritical services
50
Denial of noncritical services
60
Significant impact to critical services
70
Denial of critical services or loss of control
100
Nathan discovers a malware package on an end-user workstation. What rating should he give this if he is considering organization impact based on the table shown?
No impact
No impact to services
Denial of noncritical services
Denial of critical services or loss of control
Nathan's organization uses a software-as-a-service (SaaS) tool to manage their customer mailing lists, which they use to inform customers of upcoming sales a week in advance. The organization's primary line of business software continues to function and merchandise can be sold. Because of a service outage, they are unable to add new customers to the list for a full business day. How should Nathan rate this local impact issue during the outage?
Minimal impact to noncritical services
Minimal impact to critical services
Significant impact to noncritical services
Denial of noncritical services
During an investigation into a compromised system, Nathan discovers signs of an advanced persistent threat (APT) resident in his organization's administrative systems. How should he classify this threat?
Significant impact to noncritical services
Denial of noncritical services
Significant impact to critical services
Denial of critical services or loss of control
Melissa is using the US-CERT's scale to measure the impact of the location of observed activity by a threat actor. Which of the following should be the highest rated threat activity location?
Critical system screened subnet (DMZ)
Business network
Business screened subnet (DMZ)
Safety systems
Derek's organization has been working to recover from a recent malware infection that caused outages across the organization during an important part of their business cycle. To properly triage, what should Derek pay the most attention to first?
The immediate impact on operations so that his team can restore functionality
The total impact of the event so that his team can provide an accurate final report
The immediate impact on operations so that his team can identify the likely threat actor
The total impact of the event so that his team can build a new threat model for future use
Jeff discovers multiple JPEG photos during his forensic investigation of a computer involved in an incident. When he runs exiftool to gather file metadata, which information is not likely to be part of the images even if they have complete metadata intact?
GPS location
Camera type
Number of copies made
Correct date/timestamp
John has designed his network as shown here and places untrusted systems that want to connect to the network into the Guests network segment. What is this type of segmentation called?
Proactive network segmentation
Isolation
Quarantine
Removal
The organization that Jamal works for classifies security related events using NIST's standard definitions. Which classification should he use when he discovers key logging software on one of his frequent business travelers' laptop?
An event
An adverse event
A security incident
A policy violation
Dan is designing a segmented network that places systems with different levels of security requirements into different subnets with firewalls and other network security devices between them. What phase of the incident response process is Dan in?
Post-incident activity
Detection and analysis
Preparation
Containment, eradication, and recovery
Lauren wants to create a backup of Linux permissions before making changes to the Linux workstation she is attempting to remediate. What Linux tool can she use to back up the permissions of an entire directory on the system?
She can use chbkup.
She can use getfacl.
She can use aclman.
There is not a common Linux permission backup tool.
While working to restore systems to their original configuration after a long-term APT compromise, Manish has three options.
He can restore from a backup and then update patches on the system.
He can rebuild and patch the system using original installation media and application software using his organization's build documentation.
He can remove the compromised accounts and rootkit tools and then fix the issues that allowed the attackers to access the systems.
Which option should Manish choose in this scenario?
Option A.
Option B.
Option C.
None of the above. Manish should hire a third party to assess the systems before proceeding.
Jessica wants to access a macOS FileVault 2–encrypted drive. Which of the following methods is not a possible means of unlocking the volume?
Change the FileVault key using a trusted user account.
Retrieve the key from memory while the volume is mounted.
Acquire the recovery key.
Extract the keys from iCloud.
Susan discovers the following log entries that occurred within seconds of each other in her Squert (a Sguil web interface) console. What have her network sensors most likely detected?
A failed database connection from a server
A denial-of-service attack
A port scan
A misconfigured log source
If Suki wants to purge a drive, which of the following options will accomplish her goal?
Cryptographic erase
Reformat
Overwrite
Repartition
While performing post-rebuild validation efforts, Scott scans a server from a remote network and sees no vulnerabilities. Joanna, the administrator of the machine, runs a scan and discovers two critical vulnerabilities and five moderate issues. What is most likely causing the difference in their reports?
Different patch levels were used during the scans.
They are scanning through a load balancer.
There is a firewall between the remote network and the server.
Scott or Joanna ran the vulnerability scan with different settings.
As part of his organization's cooperation in a large criminal case, Adam's forensic team has been asked to send a forensic image of a highly sensitive compromised system in RAW format to an external forensic examiner. What steps should Adam's team take prior to sending a drive containing the forensic image?
Encode in EO1 format and provide a hash of the original file on the drive.
Encode in FTK format and provide a hash of the new file on the drive.
Encrypt the RAW file and transfer a hash and key under separate cover.
Decrypt the RAW file and transfer a hash under separate cover.
Mika wants to analyze the contents of a drive without causing any changes to the drive. What method is best suited to ensuring this?
Set the “read-only” jumper on the drive.
Use a write blocker.
Use a read blocker.
Use a forensic software package.
What type of forensic investigation–related form is shown here?
Chain of custody
Report of examination
Forensic discovery log
Policy custody release
James wants to determine whether other Windows systems on his network are infected with the same malware package that he has discovered on the workstation he is analyzing. He has removed the system from his network by unplugging its network cable, as required by corporate policy. He knows that the system has previously exhibited beaconing behavior and wants to use that behavior to identify other infected systems. How can he safely create a fingerprint for this beaconing without modifying the infected system?
Plug the system into the network and capture the traffic quickly at the firewall using Wireshark or tcpdump.
Plug the system into an isolated switch and use a span port or tap and Wireshark/tcpdump to capture traffic.
Review the ARP cache for outbound traffic.
Review the Windows Defender Firewall log for traffic logs.
After completing an incident response process and providing a final report to management, what step should Casey use to identify improvement to her incident response plan?
Update system documentation.
Conduct a lessons learned session.
Review patching status and vulnerability scans.
Engage third-party consultants.
During a forensic investigation, Lukas discovers that he needs to capture a virtual machine that is part of the critical operations of his company's website. If he cannot suspend or shut down the machine for business reasons, what imaging process should he follow?
Perform a snapshot of the system, boot it, suspend the copied version, and copy the directory it resides in.
Copy the virtual disk files and then use a memory capture tool.
Escalate to management to get permission to suspend the system to allow a true forensic copy.
Use a tool like the Volatility Framework to capture the live machine completely.
Mika, a computer forensic examiner, receives a PC and its peripherals that were seized as forensic evidence during an investigation. After she signs off on the chain of custody log and starts to prepare for her investigation, one of the first things she notes is that each cable and port was labeled with a color-coded sticker by the onsite team. Why are the items labeled like this?
To ensure chain of custody
To ensure correct reassembly
To allow for easier documentation of acquisition
To tamper-proof the system
While reviewing her Nagios logs, Selah discovers the error message shown here. What should she do about this error?
Check for evidence of a port scan.
Review the Apache error log.
Reboot the server to restore the service.
Restart the Apache service.
Lakshman needs to sanitize hard drives that will be leaving his organization after a lease is over. The drives contained information that his organization classifies as sensitive data that competitors would find valuable if they could obtain it. Which choice is the most appropriate to ensure that data exposure does not occur during this process?
Clear, validate, and document.
Purge the drives.
Purge, validate, and document.
The drives must be destroyed to ensure no data loss.
Selah is preparing to collect a forensic image for a Macintosh computer running the Ventura operating system. What hard drive format is she most likely to encounter?
FAT32
MacFAT
APFS
HFS+
During a forensic analysis of an employee's computer as part of a human resources investigation into misuse of company resources, Tim discovers a program called Eraser installed on the PC. What should Tim expect to find as part of his investigation?
A wiped C: drive
Antiforensic activities
All slack space cleared
Temporary files and Internet history wiped
Jessica wants to recover deleted files from slack space and needs to identify where the files begin and end. What is this process called?
Slacking
Data carving
Disk recovery
Header manipulation
Latisha is the IT manager for a small company and occasionally serves as the organization's information security officer. Who would be the most appropriate leader for her organization's CSIRT?
Her lead IT support staff technician.
Her organization's legal counsel.
A third-party IR team lead.
She should select herself.
During her forensic analysis of a Windows system, Cynthia accesses the registry and checks \HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionWinlogin (as shown here). What domain was the system connected to, and what was the username that would appear at login?
Admin, administrator
No domain, administrator
Legal, admin
Corporate, no default username
Alex suspects that an attacker has modified a Linux executable using static libraries. Which of the following Linux commands is best suited to determining whether this has occurred?
file
stat
strings
grep
Because of external factors, Eric has only a limited time period to collect an image from a workstation. If he collects only specific files of interest, what type of acquisition has he performed?
Logical
Bit-by-bit
Sparse
None of the above
During a forensic investigation, Kwame records information about each drive, including where it was acquired, who made the forensic copy, the MD5 hash of the drive, and other details. What term describes the process Kwame is using as he labels evidence with details of who acquired and validated it?
Direct evidence
Circumstantial evidence
Incident logging
Chain of custody
Susan needs to perform forensics on a virtual machine. What process should she use to ensure she gets all of the forensic data she may need?
Suspend the machine and copy the contents of the directory it resides in.
Perform a live image of the machine.
Suspend the machine and make a forensic copy of the drive it resides on.
Turn the virtual machine off and make a forensic copy of it.
Allison wants to access Chrome logs as part of a forensic investigation. What format is information about cookies, history, and saved form responses saved in?
SQLite
Plain text
Base64-encoded text
NoSQL
While Chris is attempting to image a device, he encounters write issues and cannot write the image as currently set (refer to the image shown here). What issue is he most likely encountering?
The files need to be compressed.
The destination drive is formatted FAT32.
The destination drive is formatted NTFS.
The files are encrypted.
Saanvi needs to validate the MD5 checksum of a file on a Windows system to ensure that there were no unauthorized changes to the binary file. He is not allowed to install any programs and cannot run files from external media or drives. What Windows utility can he use to get the MD5 hash of the file?
md5sum
certutil
sha1sum
hashcheck
Forensic investigation shows that the target of an investigation used the Windows Quick Format command to attempt to destroy evidence on a USB thumb drive. Which of the NIST sanitization techniques has the target of the investigation used in their attempt to conceal evidence?
Clear
Purge
Destroy
None of the above
During an incident response process, Susan plugs a system back into the network, allowing it normal network access. What phase of the incident response process is Susan performing?
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident activity
Mei's team has completed the initial phases of their incident response process and is assessing the time required to recover from the incident. Using the NIST recoverability effort categories, the team has determined that they can predict the time to recover but will require additional resources. How should she categorize this using the NIST model?
Regular
Supplemented
Extended
Not recoverable
Janet is attempting to conceal her actions on a company-owned computer. As part of her cleanup attempts, she deletes all the files she downloaded from a corporate file server using a browser in incognito mode. How can a forensic investigator determine what files she downloaded?
Network flows
SMB logs
Browser cache
Drive analysis
Jose is aware that an attacker has compromised a system on his network but wants to continue to observe the attacker's efforts as they continue their attack. If Jose wants to prevent additional impact on his network while watching what the attacker does, what containment method should he use?
Removal
Isolation
Segmentation
Detection
When Abdul arrived at work this morning, he found an email in his inbox that read, “Your systems are weak; we will own your network by the end of the week.” How would he categorize this sign of a potential incident if he was using the NIST SP 800-61 descriptions of incident signs?
An indicator
A threat
A risk
A precursor
During an incident response process, Cynthia conducts a lessons learned review. What phase of the incident response process is she in?
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident recovery
As part of his incident response program, Allan is designing a playbook for zero-day threats. Which of the following should not be in his plan to handle them?
Segmentation
Patching
Using threat intelligence
Allow listing/whitelisting
As the CISO of her organization, Mei is working on an incident classification scheme and wants to base her design on NIST's definitions. Which of the following options should she use to best describe a user accessing a file that they are not authorized to view?
An incident
An event
An adverse event
A security incident
Fred wants to identify digital evidence that can place an individual in a specific place at a specific time. Which of the following types of digital forensic data is not commonly used to attempt to document physical location at specific times?
Cell phone GPS logs
Photograph metadata
Cell phone tower logs
Microsoft Office document metadata
Kai has completed the validation process of her media sanitization efforts and has checked a sample of the drives she had purged using a built-in cryptographic wipe utility. What is her next step?
Resample to validate her testing.
Destroy the drives.
Create documentation.
She is done and can send the drives on for disposition.
In his role as a small company's information security manager, Mike has a limited budget for hiring permanent staff. Although his team can handle simple virus infections, he does not currently have a way to handle significant information security incidents. Which of the following options should Mike investigate to ensure that his company is prepared for security incidents?
Outsource to a third-party SOC.
Create an internal SOC.
Hire an internal incident response team.
Outsource to an incident response provider.
Bohai wants to ensure that media has been properly sanitized. Which of the following options properly lists sanitization descriptions from least to most effective?
Purge, clear, destroy
Eliminate, eradicate, destroy
Clear, purge, destroy
Eradicate, eliminate, destroy
Degaussing is an example of what form of media sanitization?
Clearing.
Purging.
Cryptoshredding.
It is not a form of media sanitization.
While reviewing storage usage on a Windows system, Brian checks the volume shadow copy storage as shown here:
C:WINDOWSsystem32>vssadmin list Shadowstorage vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool (C) Copyright 2001-2013 Microsoft Corp. Shadow Copy Storage association For volume: (C:)\?Volume{c3b53dae-0e54-13e3-97ab-806e6f6e69633} Shadow Copy Storage volume: (C:)\?Volume{c3b53dae-0e54-13e3-97ab-806e6f6e6963} Used Shadow Copy Storage space: 25.6 GB (2%) Allocated Shadow Copy Storage space: 26.0 GB (2%) Maximum Shadow Copy Storage space: 89.4 GB (10%)
What purpose does this storage serve, and can he safely delete it?
It provides a block-level snapshot and can be safely deleted.
It provides secure hidden storage and can be safely deleted.
It provides secure hidden storage and cannot be safely deleted.
It provides a block-level snapshot and cannot be safely deleted.
Lauren recovers a number of 16GB and 32GB microSD cards during a forensic investigation. Without checking them manually, what filesystem type is she most likely to find them formatted in as if they were used with a digital camera?
RAW
FAT16
FAT32
APFS
After arriving at an investigation site, Brian determines that three powered-on computers need to be taken for forensic examination. What steps should he take before removing the PCs?
Power them down, take pictures of how each is connected, and log each system in as evidence.
Take photos of each system, power them down, and attach a tamper-evident seal to each PC.
Collect live forensic information, take photos of each system, and power them down.
Collect a static drive image, validate the hash of the image, and securely transport each system.
In his role as a forensic examiner, Lukas has been asked to produce forensic evidence related to a civil case. What is this process called?
Criminal forensics
E-discovery
Cyber production
Civil tort
As Mika studies her company's computer forensics playbook, she notices that forensic investigators are required to use a chain of custody form. Which of the following best describes the information that she should record on that form if she was conducting a forensic investigation?
The list of individuals who made contact with files leading to the investigation
The list of former owners or operators of the PC involved in the investigation
All individuals who work with evidence in the investigation
The police officers who take possession of the evidence
Scott needs to ensure that the system he just rebuilt after an incident is secure. Which type of scan will provide him with the most useful information to meet his goal?
An authenticated vulnerability scan from a trusted internal network
An unauthenticated vulnerability scan from a trusted internal network
An authenticated scan from an untrusted external network
An unauthenticated scan from an untrusted external network
What is the primary role of management in the incident response process?
Leading the CSIRT
Acting as the primary interface with law enforcement
Providing authority and resources
Assessing impact on stakeholders
Max wants to improve the effectiveness of the incident analysis process he is responsible for as the leader of his organization's CSIRT. Which of the following is not a commonly recommended best practice based on NIST's guidelines?
Profile networks and systems to measure the characteristics of expected activity.
Perform event correlation to combine information from multiple sources.
Maintain backups of every system and device.
Capture network traffic as soon as an incident is suspected.
NIST describes four major phases in the incident response cycle. Which of the following is not one of the four?
Containment, eradication, and recovery
Notification and communication
Detection and analysis
Preparation
Charles wants to perform memory forensics on a Windows system and wants to access pagefile.sys. When he attempts to copy it, he receives the following error. What access method is required to access the page file?
Run Windows File Explorer as an administrator and repeat the copy.
Open the file using fmem.
Run cmd.exe as an administrator and repeat the copy.
Shut the system down, remove the drive, and copy it from another system.
Where is slack space found in the following Windows partition map?
The System Reserved partition
The System Reserved and Unallocated partitions
The System Reserved and C: partitions
The C: and unallocated partitions
Ty needs to determine the proper retention policy for his organization's incident data. If he wants to follow common industry practices and does not have specific legal or contractual obligations that he needs to meet, what timeframe should he select?
30 days
90 days
1 to 2 years
7 years
The system that Alice has identified as the source of beaconing traffic is one of her organization's critical e-commerce servers. To maintain her organization's operations, she needs to quickly restore the server to its original, uncompromised state. What criterion is likely to be impacted the most by this action?
Damage to the system or service
Service availability
Ability to preserve evidence
Time and resources needed to implement the strategy
Piper wants to create a forensic image that third-party investigators can use but does not know what tool the third-party investigation team that her company intends to engage will use. Which of the following forensic formats should she choose if she wants almost any forensic tool to be able to access the image?
E01
AFF
RAW
AD1
As part of his forensic investigation, Scott intends to make a forensic image of a network share that is mounted by the PC that is the focus of his investigation. What information will he be unable to capture?
File creation dates
Deleted files
File permission data
File metadata
What common incident response follow-up activity includes asking questions like “What additional tools or resources are needed to detect or analyze future events?”
Preparation
Lessons learned review
Evidence gathering
Procedural analysis
Suki has been asked to capture forensic data from a Windows PC and needs to ensure that she captures the data in their order of volatility. Which order is correct from most to least volatile?
Network traffic, CPU cache, disk drives, optical media
CPU cache, network traffic, disk drives, optical media
Optical media, disk drives, network traffic, CPU cache
Network traffic, CPU cache, optical media, disk drives
During an incident response process, Suki heads to a compromised system and disconnects its network cable. What phase of the incident response process is Suki performing?
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident activity
Scott needs to verify that the forensic image he has created is an exact duplicate of the original drive. Which of the following methods is considered forensically sound?
Create a MD5 hash
Create a SHA-1 hash
Create a SHA-2 hash
All of the above
What strategy does NIST suggest for identifying attackers during an incident response process?
Use geographic IP tracking to identify the attacker's location.
Contact upstream ISPs for assistance in tracking down the attacker.
Contact local law enforcement so that they can use law enforcement–specific tools.
Identifying attackers is not an important part of the incident response process.
While performing forensic analysis of an iPhone backup, Cynthia discovers that she has only some of the information that she expects the phone to contain. What is the most likely scenario that would result in the backup she is using having partial information?
The backup was interrupted.
The backup is encrypted.
The backup is a differential backup.
The backup is stored in iCloud.
Cullen wants to ensure that his chain of custody documentation will stand up to examination in court. Which of the following options will provide him with the best documentary proof of his actions?
A second examiner acting as a witness and countersigning all actions
A complete forensic logbook signed and sealed by a notary public
A documented forensic process with required sign-off
Taking pictures of all independent forensic actions
Cynthia is reviewing her organization's incident response recovery process, which is outlined here. Which of the following recommendations should she make to ensure that further issues do not occur during the restoration process?
Change passwords before restoring from backup.
Isolate the system before restoring from backups.
Securely wipe the drive before restoration.
Vulnerability scan before patching.
Saria is reviewing the contents of a drive as part of a forensic effort and notes that the file she is reviewing takes up more space on the disk than its actual size, as shown here. What has she discovered?
Slack space
Hidden content
Sparse files
Encryption overhead
Kathleen is restoring a critical business system to operation after a major compromise and needs to validate that the operating system and application files are legitimate and do not have any malicious code included in them. What type of tool should she use to validate this?
A trusted system binary kit
Dynamic code analysis
Static code analysis
File rainbow tables
Mel is creating the evidence log for a computer that was part of an attack on an external third-party system. What network-related information should he include in that log if he wants to follow NIST's recommendations?
Subnet mask, DHCP server, hostname, MAC address
IP addresses, MAC addresses, hostname
Domain, hostname, MAC addresses, IP addresses
NIC manufacturer, MAC addresses, IP addresses, DHCP configuration
Ryan believes that systems on his network have been compromised by an advanced persistent threat actor. He has observed a number of large file transfers outbound to remote sites via TLS-protected HTTP sessions from systems that do not typically send data to those locations. Which of the following techniques is most likely to detect the APT infections?
Network traffic analysis
Network forensics
Endpoint behavior analysis
Endpoint forensics
Ben is investigating a potential malware infection of a laptop belonging to a senior manager in the company he works for. When the manager opens a document, website, or other application that takes user input, words start to appear as though they are being typed. What is the first step that Ben should take in his investigation?
Run an antivirus scan.
Disconnect the system from the network.
Wipe the system and reinstall.
Observe and record what is being typed.
Kathleen's forensic analysis of a laptop that is believed to have been used to access sensitive corporate data shows that the suspect tried to overwrite the data they downloaded as part of antiforensic activities by deleting the original files and then copying other files to the drive. Where is Kathleen most likely to find evidence of the original files?
The MBR
Unallocated space
Slack space
The FAT
Angela wants to access the decryption key for a BitLocker-encrypted system, but the system is currently turned off. Which of the following methods is a viable method if a Windows system is turned off?
Hibernation file analysis
Memory analysis
Boot-sector analysis
Brute-force cracking
Adam believes that a system on his network is infected but does not know which system. To detect it, he creates a query for his network monitoring software based on the following pseudocode. What type of traffic is he most likely trying to detect?
destip: [*] and duration < 10 packets and destbytes < 3000 and flowcompleted = true and application = http or https or tcp or unknown and content != uripath:* and content != contentencoding:*
Users browsing malicious sites
Adware
Beaconing
Outbound port scanning
As an employee of the U.S. government, Megan is required to use NIST's information impact categories to classify security incidents. During a recent incident, proprietary information was changed. How should she classify this incident?
As a privacy breach
As an integrity loss
As a proprietary breach
As an availability breach
During what stage of an event is preservation of evidence typically handled?
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident activity
Lukas wants to purge a drive to ensure that data cannot be extracted when it is sent offsite. Which of the following is not a valid option for purging hard drives on a Windows system?
Use the built-in Windows sdelete command line.
Use Eraser.
Use DBAN.
Encrypt the drive and then delete the key.
Which of the following is not a valid use case for live forensic imaging?
Malware analysis
Encrypted drives
Postmortem forensics
Nonsupported filesystems
While reviewing the actions taken during an incident response process, Mei is informed by the local desktop support staff person that the infected machine was returned to service by using a Windows System Restore point. Which of the following items will a Windows System Restore return to a previous state?
Personal files
Malware
Windows system files
All installed apps
During a major incident response effort, Kobe discovers evidence that a critical application server may have been the data repository and egress point in the compromise he is investigating. If he is unable to take the system offline, which of the following options will provide him with the best forensic data?
Reboot the server and mount the system drive using a USB-bootable forensic suite.
Create an image using a tool like FTK Imager Lite.
Capture the system memory using a tool like Volatility.
Install and run an imaging tool on the live server.
Manish finds the following entries on a Linux system in /var/log/auth.log. If he is the only user with root privileges, requires two-factor authentication to log in as root, and did not take the actions shown, what should he check for?
A hacked root account
A privilege escalation attack from a lower privileged account or service
A malware infection
A RAT
As part of his forensic analysis of a series of photos, John runs exiftool for each photo. He receives the following listing from one photo. What useful forensic information can he gather from this photo?
The original creation date, the device type, the GPS location, and the creator's name
The endian order of the file, the file type, the GPS location, and the scene type
The original creation date, the device type, the GPS location, and manufacturer of the device
The MIME type, the GPS time, the GPS location, and the creator's name
During the preparation phase of his organization's incident response process, Oscar gathers a laptop with useful software including a sniffer and forensics tools, thumb drives and external hard drives, networking equipment, and a variety of cables. What is this type of preprepared equipment commonly called?
A grab bag
A jump kit
A crash cart
A first responder kit
As John proceeds with a forensic investigation involving numerous images, he finds a directory labeled Downloaded from Facebook. The images appear relevant to his investigation, so he processes them for metadata using exiftool. The following image shows the data provided. What forensically useful information can John gather from this output?
The original file creation date and time.
The device used to capture the image.
The original digest (hash) of the file, allowing comparison to the original.
None; Facebook strips almost all useful metadata from images.
Which of the following properly lists the order of volatility from least to most volatile?
Printouts, swap files, CPU cache, RAM
Hard drives, USB media, DVDs, CD-RWs
DVDs, hard drives, virtual memory, caches
RAM, swap files, SSDs, printouts
While conducting a forensic review of a system involved in a data breach, Alex discovers a number of Microsoft Word files including files with filenames like critical_data.docx and sales_estimates_2023.docx. When he attempts to review the files using a text editor for any useful information, he finds only unreadable data. What has occurred?
Microsoft Word files are stored in ZIP format.
Microsoft Word files are encrypted.
Microsoft Word files can be opened only by Microsoft Word.
The user has used antiforensic techniques to scramble the data.
Lukas believes that one of his users has attempted to use built-in Windows commands to probe servers on the network he is responsible for. How can he recover the command history for that user if the system has been rebooted since the reconnaissance has occurred?
Check the Bash history.
Open a command prompt window and press F7.
Manually open the command history from the user's profile directory.
The Windows command prompt does not store command history.
Angela is conducting an incident response exercise and needs to assess the economic impact on her organization of a $500,000 expense related to an information security incident. How should she categorize this?
Low impact.
Medium impact.
High impact.
Angela cannot assess the impact with the data given.
What step follows sanitization of media according to NIST guidelines for secure media handling?
Reuse
Validation
Destruction
Documentation
Latisha wants to create a documented chain of custody for the systems that she is handling as part of a forensic investigation. Which of the following will provide her with evidence that systems were not tampered with while she is not working with them?
A chain of custody log
Tamper-proof seals
System logs
None of the above
Matt's incident response team has collected log information and is working on identifying attackers using that information. What two stages of the NIST incident response process is his team working in?
Preparation and containment, eradication, and recovery
Preparation and post-incident activity
Detection and analysis, and containment, eradication, and recovery
Containment, eradication, and recovery and post-incident activity
Raj discovers that the forensic image he has attempted to create has failed. What is the most likely reason for this failure?
Data was modified.
The source disk is encrypted.
The destination disk has bad sectors.
The data cannot be copied in RAW format.
Liam notices the following entries in his Squert web console (a web console for Sguil IDS data). What should he do next to determine what occurred?
Review SSH logs.
Disable SSH and then investigate further.
Disconnect the server from the Internet and then investigate.
Immediately change his password.
Which of the following activities is not part of the containment and restoration process?
Minimizing loss
Identifying the attacker
Limiting service disruption
Rebuilding compromised systems
Samantha has recently taken a new position as the first staff security analyst that her employer has ever had. During her first week, she discovers that there is no information security policy and that the IT staff do not know what to do during a security incident. Samantha plans to start up a CSIRT to handle incident response. What type of documentation should she provide to describe specific procedures that the CSIRT will use during events like malware infections and server compromise?
An incident response policy
An operations manual
An incident response program
A playbook
What is space between the last sector containing logical data and the end of the cluster called?
Unallocated space
Ephemeral space
Slack space
Unformatted space
Jack is preparing to take a currently running PC back to his forensic lab for analysis. As Jack considers his forensic process, one of his peers recommends that he simply unplug the power cable rather than doing a software-based shutdown. Why might Jack choose to follow this advice?
It will create a crash log, providing useful memory forensic information.
It will prevent shutdown scripts from running.
It will create a memory dump, providing useful forensic information.
It will cause memory-resident malware to be captured, allowing analysis.
Rick wants to validate his recovery efforts and intends to scan a web server he is responsible for with a scanning tool. What tool should he use to get the most useful information about system vulnerabilities?
Wapiti
Nmap
OpenVAS
ZAP
What is the key goal of the containment stage of an incident response process?
To limit leaks to the press or customers
To limit further damage from occurring
To prevent data exfiltration
To restore systems to normal operation
What level of forensic data extraction will most likely be possible and reasonable for a corporate forensic examiner who deals with modern phones that provide filesystem encryption?
Level 1: Manual extraction
Level 2: Logical extraction
Level 3: JTAG or HEX dumping
Level 4: Chip extraction
Wang believes that a Windows system he is responsible for is compromised and wants to monitor traffic to and from it. Which of the following is not a typical capture option in circumstances like these?
A packet capture tool installed on the system
A packet capture tool on another system on the same network
Packet capture at the network edge
Packet capture at the network core
Carol has discovered an attack that appears to be following the process flow shown here. What type of attack should she identify this as?
Phishing
Zero-day exploit
Whaling
Advanced persistent threat
Refer to the image shown here for questions 124–126.
During an e-discovery process, Carol reviews the request from opposing counsel and builds a list of all the individuals identified. She then contacts the IT staff who support each person to request a list of their IT assets. What phase of the EDRM flow is she in?
Information governance
Identification
Preservation
Collection
During the preservation phase of her work, Carol discovers that information requested as part of the discovery request has been deleted as part of a regularly scheduled data cleanup as required by her organization's policies. What should Carol do?
Conduct a forensic recovery of the data.
Create synthetic data to replace the missing data.
Report the issue to counsel.
Purge any other data related to the request based on the same policy.
In what phase should Carol expect to spend the most person-hours?
Identification
Collection and preservation
Processing, review, and analysis
Production
The incident response kit that Cassandra is building is based around a powerful laptop so that she can perform onsite drive acquisitions and analysis. If she expects to need to acquire data from SATA, SSD, and flash drives, what item should she include in her kit?
A write blocker
A USB hard drive
A multi-interface drive adapter
A USB-C cable
Which of the following items is not typically found in corporate forensic kits?
Write blockers
Crime scene tape
Label makers
Decryption tools
What incident response tool should Kai build prior to an incident to ensure that staff can reach critical responders when needed?
A triage triangle
A call list
A call rotation
A responsibility matrix
Greg finds a series of log entries in his web server logs showing long strings "AAAAAAAAAAAAAAAAAAAAAAA", followed by strings of characters. What type of attack has he most likely discovered?
A SQL injection attack
A denial-of-service attack
A buffer overflow attack
A PHP string-ring attack
During a security incident, Joanna makes a series of changes to production systems to contain the damage. What type of change should she file in her organization's change control process when the response effort is concluding?
Routine change
Priority change
Emergency change
Pre-approved change
Which one of the following incident response test types provides an interactive exercise for the entire team but does not run the risk of disrupting normal business activity?
Full interruption test
Checklist review
Management review
Tabletop exercise
Which of the following cloud service environments is likely to provide the best available information for forensic analysis?
SaaS
IaaS
PaaS
IDaaS
Ken is helping his organization prepare for future incident response efforts and would like to ensure that they conduct regular training exercises. Which one of the following exercises could he use to remind incident responders of their responsibilities with the least impact on other organizational priorities?
Checklist review
Structured walk-through
Capture the flag
Tabletop exercise
When analyzing network traffic for indicators of compromise, which one of the following service/port pairings would indicate a common protocol running on a nonstandard port?
HTTPS on TCP port 443
RDP on TCP port 3389
SSH on TCP port 1433
HTTP on TCP port 80
Camilla is participating in the eradication and recovery stage of an incident response process. Which one of the following activities would not normally occur during this phase?
Vulnerability mitigation
Restoration of permissions
Verification of logging/communication to security monitoring
Analysis of drive capacity consumption
What type of exercise actually activates an organization's incident response plan but has the lowest likelihood of disrupting normal activities?
Checklist review
Tabletop exercise
Full interruption test
Parallel test
Which one of the following events is least likely to trigger the review of an organization's information security program?
Security incident
Changes in compliance obligations
Changes in team members
Changes in business processes
The Open Source Security Testing Methodology Manual (OSS TMM) is focused on testing in three major areas. Which one of the following is not one of those areas?
Physical locations
Communications
Web servers
Human interactions
Kevin is conducting an assessment of a web application using the OWASP Testing Guide. He is searching for XSS vulnerabilities in the application and would like to use an approach that balances the time required to conduct the testing and the effectiveness of the test. Which approach would be most appropriate?
Use an automated testing tool.
Conduct a penetration test.
Test each input field manually.
Interview the software developers.
What is the minimum interval at which an organization should conduct business continuity plan refresher training for those with specific business continuity roles?
Weekly
Monthly
Semiannually
Annually
Which one of the following programs has the primary goal of ensuring that an organization is able to maintain normal operations during a disaster or other disruption?
Disaster recovery
Incident response
Risk management
Business continuity
Which one of the following programs has the primary goal of helping the organization quickly recover normal operations if they are disrupted?
Disaster recovery
Incident response
Risk management
Business continuity
During what phase of the incident response process would an organization implement defenses designed to reduce the likelihood of a security incident?
Preparation
Detection and analysis
Containment, eradication, and recovery
Post-incident activity
After wrapping up an incident response investigation, Chris is attempting to determine what went wrong so that he can implement new security controls that will prevent similar incidents in the future. What term best describes his work?
Lessons learned review
Post-incident activity
Incident management
Root-cause analysis
What common criticism is leveled at the Cyber Kill Chain?
Not all threats are aimed at a kill.
It is too detailed.
It includes actions outside the defended network.
It focuses too much on insider threats.
Tamara is a cybersecurity analyst for a private business that is suffering a security breach. She believes the attackers have compromised a database containing sensitive information. Which one of the following activities should be Tamara's first priority?
Identifying the source of the attack
Eradication
Containment
Recovery
Robert is finishing a draft of a proposed incident response policy for his organization. Who would be the most appropriate person to sign the policy?
CEO
Director of security
CIO
CSIRT leader
Which one of the following is not an objective of the containment, eradication, and recovery phase of incident response?
Detect an incident in progress.
Implement a containment strategy.
Identify the attackers.
Eradicate the effects of the incident.
Which one of the following is not a phase of the threat lifecycle addressed in the MITRE ATT&CK model?