Examkin

Soru

Zorluk: Çok zorDigital Forensics and Chain of Custody

A security operations team identifies active network exfiltration originating from a compromised, ephemeral container running on a live enterprise Linux host. Enterprise auto-scaling rules are triggered, which will automatically terminate and delete the container instance within minutes. To preserve forensic evidence for legal proceedings while strictly adhering to the order of volatility, which of the following actions should the incident responder take FIRST?

  1. Acquire the live RAM dump of the host and container execution memory before shutting down or imaging persistent storage volumes.Cevap
  2. B
    Immediately capture a bit-stream forensic image of the persistent storage volume to prevent log rotation and deletion.
  3. C
    Issue a graceful container termination command to freeze the file system state prior to computing drive cryptographic hashes.
  4. D
    Generate an asymmetric digital signature for the container image in the centralized registry to enforce legal non-repudiation before memory collection.

Cevap

Acquiring the live RAM dump of the host and container execution memory before shutting down or imaging persistent storage volumes.
The correct response recognizes that volatile memory (system RAM, process memory, kernel structures) must be captured first according to the standard forensic Order of Volatility (CPU registers/cache -> RAM -> Swap -> Disk -> Remote logs -> Archival media). Because the container instance is ephemeral and actively running, stopping or imaging storage first will irrevocably destroy critical runtime evidence held only in RAM.

Adım Adım Çözüm

1
Assess the order of volatility for digital evidence.
Identify that volatile memory (RAM, CPU cache, active network connections) disappears immediately upon system state changes or host shutdown.
RAM is higher on the volatility hierarchy than persistent disk storage or archival backups.
2
Prioritize memory capture over persistent disk imaging.
Capture live host RAM and container execution state memory prior to taking storage snapshots or issuing process management commands.
Ephemeral containers lose all runtime memory and state artifacts permanently once terminated.
3
Calculate cryptographic hashes of acquired memory and storage artifacts.
Ensure integrity verification and chain of custody documentation for all collected forensic artifacts.
Maintaining verifiable cryptographic hashes guarantees evidence integrity in legal proceedings.

Anahtar Kavram

Order of Volatility in Digital Forensics
Bu soruyu puanla

Konular

Digital Forensics and Chain of Custody

Bu konudan daha fazla soru