U11-E2-recap

What is the term for the record that should be made at the time or as soon after the incident as possible?

• Incident report

• Forensic log

• Chain of custody

• Evidence summary

What is the purpose of retaining snapshots of the system during the forensic analysis?

• To preserve the state of the system at different points in time

• To compare the system with other similar systems

• To create visual evidence of the system's appearance

• To backup the system in case of data loss

What is one of the requirements for the recording of all findings in the forensic analysis?

• The findings should be recorded in a chronological order

• The findings should be recorded in a digital format

• The findings should be recorded in a clear and concise manner

• The findings should be recorded in a secure location

What is one of the requirements for the recording of any alterations that have been intentionally and unintentionally imposed by the investigator?

• The alterations should be recorded in a separate file from the findings

• The alterations should be recorded with the date, time, and reason for each change

• The alterations should be recorded with the name, role, and contact of the person who made the change

• The alterations should be recorded with the impact, risk, and mitigation of each change

What is one of the requirements for the creation of visual evidence of findings?

• The visual evidence should be created using a standard format and tool

• The visual evidence should be created with a clear and accurate label and caption

• The visual evidence should be created with a high resolution and quality

• The visual evidence should be created with a watermark and signature

What is one of the ways to ensure the evidence is relevant and not a false positive?

• To verify the evidence with multiple sources and methods

• To eliminate the evidence that is not related to the incident

• To compare the evidence with the baseline and normal behaviour of the system

• To validate the evidence with the stakeholders and experts

What is one of the criteria for evaluating the findings to determine whether or not they provide evidence of a crime and/or an incident?

• The findings should be consistent with the incident report and the system logs

• The findings should be supported by the relevant laws and regulations

• The findings should be sufficient to prove the cause and effect of the incident

• The findings should be conclusive and not leave any room for doubt or alternative explanations

What is one of the criteria for evaluating the findings to determine whether or not they show that the system has been externally and/or internally compromised?

• The findings should show the presence of unauthorized access or modification of the system

• The findings should show the impact and damage of the compromise on the system

• The findings should show the motive and intention of the compromise on the system

• The findings should show the source and origin of the compromise on the system

What is one of the criteria for evaluating the findings to determine whether or not they strongly support one possible cause more than other possible causes?

• The findings should be based on facts and logic rather than assumptions and opinions

• The findings should be tested and verified with different scenarios and hypotheses

• The findings should be aligned with the best practices and standards of the industry

• The findings should be reviewed and confirmed by the peers and supervisors

What is one of the recommendations to prevent security incidents from reoccurring in the future, regarding the content of cyber security documentation (policies and/or agreements)?

• The content should be updated and revised regularly to reflect the current situation and needs

• The content should be clear and concise to avoid ambiguity and confusion

• The content should be comprehensive and cover all aspects of cyber security

• The content should be specific and tailored to the organisation and the system