Examkin

Soru

Zorluk: Çok zorIncident Response and Chain of Custody

A corporate IT technician discovers an active network intrusion on an administrative workstation where unauthorized data exfiltration is currently taking place. In what sequence should the technician perform the incident response, evidence preservation, and chain of custody procedures from first to last?

  1. 1Report the security incident immediately to the incident response team lead and document initial findings.
  2. 2Disconnect the physical Ethernet cable and disable wireless interfaces to isolate the workstation from the network.
  3. 3Capture the system's volatile memory (RAM) and active network connections using a specialized forensic tool.
  4. 4Power down the workstation, remove the main storage drive, and create a bit-stream forensic image using a hardware write blocker.
  5. 5Complete the chain of custody form with drive serial numbers, timestamps, and handler signatures before securing the drive in a tamper-evident bag.

Cevap

The correct sequence starts with reporting the incident, followed by isolating the host from the network, capturing volatile RAM memory, imaging the hard drive with a hardware write blocker, and finally completing the chain of custody log prior to securing physical evidence.
The correct sequence follows standard CompTIA incident response guidelines and forensic best practices. First, the technician reports the breach to initiate official escalation. Next, the network connection is severed to contain exfiltration without altering live state. Volatile memory (RAM) is captured next in accordance with the order of volatility. The system is then powered down to image non-volatile storage using a write blocker. Finally, the evidence is logged on a chain of custody form and stored securely.

Adım Adım Çözüm

1
Report the security breach and document initial observations according to escalation protocols.
Establishes formal incident management tracking and authorizes containment actions.
Proper reporting ensures security management is aware of the threat before technical steps begin.
2
Isolate the compromised system by disconnecting network connectivity.
Halts active exfiltration without altering memory contents or shutting down system processes.
Containment is the immediate technical priority to prevent further unauthorized data transfer.
3
Acquire volatile memory (RAM) and active system state.
Preserves transient forensic evidence that will be wiped if the system reboots or powers off.
Adheres to the order of volatility (RAM is more volatile than fixed mass storage).
4
Power off the machine and create a forensic image of non-volatile storage using a write blocker.
Generates a bit-stream copy of the drive for analysis without altering original evidence.
Non-volatile media is captured after RAM, and write blocking ensures evidence integrity.
5
Fill out the chain of custody log and store the drive in a tamper-evident container.
Establishes verifiable tracking of evidence custody, timestamps, and handling integrity.
Unbroken documentation is legally required to prove evidence has not been tampered with.

Anahtar Kavram

Incident Response Workflow, Order of Volatility, and Chain of Custody Maintenance
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru