Examkin

Question

Difficulty: MediumIncident Response and Chain of Custody

A corporate IT technician is notified that a remote employee's workstation may have been compromised by malware capable of exfiltrating credentials over the network. The workstation is currently powered on and connected to the internal office network via Ethernet. Which of the following immediate first-responder actions should the technician take to contain the threat while preserving volatile digital evidence? (Select TWO.)

  1. Disconnect the network cable from the workstationAnswer
  2. B
    Perform a hard power-down by unplugging the power cable
  3. Capture system RAM to external storage prior to shutting downAnswer
  4. D
    Log into the affected machine using an administrative user account to browse active process trees

Answer

The technician should disconnect the network cable from the workstation and capture system RAM to external storage prior to shutting down.
Disconnecting the physical network cable isolates the system from the network to stop data exfiltration without clearing volatile memory. Capturing system RAM prior to any shutdown ensures that volatile evidence (such as active connections and processes) is preserved in accordance with the order of volatility.

Step-by-Step Solution

1
Isolate the compromised workstation from the local network by removing the network cable.
Network communication and active exfiltration are immediately blocked while preserving the powered-on state.
Isolation stops further data leakage and prevents the threat from spreading laterally across the enterprise network.
2
Capture volatile RAM using specialized forensic acquisition tools onto external media.
Volatile memory content is successfully saved for evidence analysis.
Order of volatility dictates capturing RAM before powering off or restarting the system, as memory contains volatile evidence like encryption keys and running malicious artifacts.

Key Concept

Incident Isolation and Volatile Evidence Preservation
Rate this question

Topics

Incident Response and Chain of Custody

More questions from this topic