Examkin

Soru

Zorluk: Çok zorIncident Response and Chain of Custody

A security analyst is conducting a forensic investigation into an ongoing data exfiltration incident on a corporate desktop workstation. The machine is powered on, logged in, and actively communicating with a malicious command-and-control server. Legal protocol dictates that all gathered digital evidence must be admissible in court. Which of the following series of actions represents the correct order of first-responder procedures to isolate the threat while ensuring evidentiary integrity?

  1. Isolate the workstation from the network by removing the network cable, capture RAM contents to secure volatile memory, power down the system, and initiate an unbroken chain-of-custody log detailing handler identities and timestamps.Cevap
  2. B
    Immediately perform a hard shutdown by disconnecting the main power cord to halt data transfer, remove the storage drive, generate a cryptographic hash, and deliver the drive to forensics without logging intermediary handlers.
  3. C
    Log into the system under administrator credentials to inspect running processes, export active memory dumps to a local unencrypted USB drive, and document the findings on a ticket.
  4. D
    Attach tamper-evident tape over all physical peripheral ports, place physical cable locks on the chassis, and leave the workstation connected to the network until external law enforcement arrives.

Cevap

The technician must first isolate the workstation from the network without powering off, capture volatile RAM memory, shut down the system for drive imaging, and document an unbroken chain-of-custody log containing handler signatures, timestamps, and location details.
The correct response prioritizes containment by disconnecting the network interface while keeping power active to preserve RAM. Capturing volatile memory before shutdown strictly adheres to the Order of Volatility. Subsequently documenting handler signatures, timestamps, and location data creates a valid, unbroken chain of custody required for legal proceedings.

Adım Adım Çözüm

1
Isolate the compromised endpoint from the local network and internet
Stops active exfiltration and prevents remote attacker commands while maintaining system power.
Preserves volatile data in memory (RAM) while mitigating network risk.
2
Perform volatile memory (RAM) acquisition
Captures running processes, active connections, and unencrypted keys stored in RAM before power loss.
According to the Order of Volatility, RAM is highly transient and lost upon system shutdown.
3
Safely shut down the system and secure non-volatile storage media
Prepares physical drive for bit-level forensic imaging.
Prevents background OS tasks from overwriting disk artifacts.
4
Formally document evidence collection in the chain-of-custody log
Creates a legally binding record detailing exact timestamps, item serial numbers, purpose of transfer, and signatures of both relinquishing and receiving parties.
Maintains evidence integrity and ensures admissibility in judicial proceedings.

Anahtar Kavram

First Responder Incident Response Sequence and Chain of Custody Protocol
Bu soruyu puanla

Konular

Incident Response and Chain of Custody

Bu konudan daha fazla soru