What field allows analysts to track individual emails through various log entries when investigating IMAP clients that use the Bind operation?

• Message ID

• MailboxUPN

• Mailbox Trace

• MessageGUID

Answer explanation

IMAP (and POP3) clients will download individual emails using a Bind operation. This is an advantage, as you can track individual emails by following the "Message ID" field through various log entries.

Which PowerShell command would a security admin run to determine whether Exchange mailbox auditing was enabled?

• 
  

• Get-Mailbox –Identity admin

• • Search-Mailbox [[-Identity] <MailboxIdParameter>]

    Search-Mailbox [[-Identity] ]

• • Get-OrganizationalConfig | Format-List AuditDisabled

• • Get-OrganizationalConfig | Format-List AuditDisabled

  • Search-UnifiedAuditLog

Answer explanation

The PowerShell command "Get-OrganizationConfig | Format-List AuditDisabled" will help you confirm that audit logs are not disabled (meaning they are enabled). The double negative can be confusing: false means that auditing is turned on.

What two components are required to make a call to the Graph API and obtain an authorization token?

• • Tenant ID and authToken

• • Application ID and client secret

• • Application ID and client ID

• • Scope and operation result

Answer explanation

By providing the application ID (ClientID) and the client secret, you can make a call to the Graph API and obtain an authorization token.

What is an important consideration for DFIR when investigating incidents involving containers like Kubernetes or Docker?

• Containers make it easier to perform forensics due to their lightweight footprint.

• Specialized tooling and configurations are not required for full visibility.

• All log data may be purged on container exit.

• Access to logs must be negotiated with the cloud provider up front.

Answer explanation

Serverless and containers are hot topics. Containers are a great way to sandbox an application, while serverless is an efficient way to run a small amount of code. From a DFIR perspective, they both represent challenges. Containers are likely to purge all log data on exit, while serverless typically runs for a short amount of time, leaving very little in terms of logs.

Which of the following is the customer responsible for in the shared responsibility model of the cloud, regardless of cloud type?

Responses

• 
  

• Logical and physical network configuration

• Physical datacenter

• Information and data

• Operating system and physical hosts

Answer explanation

Each cloud vendor has a shared responsibility model explaining what they will take care of versus what the customer is expected to handle. Regardless of cloud type, the customer is ultimately responsible for the information and data they put in the cloud.

What is an important financial consideration when planning to store disks and snapshots from forensic investigations in the cloud on a long-term basis?

• Disks and snapshots have dynamic pricing based on the number of CPUs and the memory of the VM mapping them.

• Disks and snapshots have an initial, one-time cost only.

• Disk and snapshots accrue cost only when the virtual machine that maps them is running.

• Disks and snapshots accrue cost all the time, until they are deleted.

Answer explanation

Clouds use a per-consumption model, which means everything you do has a cost. Disks and snapshots are examples of persistent costs, which accrue constantly until the resource or object is deleted. There are also temporary costs, which accrue only when the resource is running, such as with a virtual machine.

Which mailbox action would move an email message to the Recoverable Items folder in Exchange?

• SoftDelete

• MailItemsAccessed

• MoveToDeletedItems

• HardDelete

Answer explanation

The SoftDelete action moves messages to the Recoverable Items folder. HardDelete purges items from that folder. MoveToDeletedItems moves them to the Deleted Items folder. MailItemsAccessed shows when items are accessed, not when they are deleted.

What is the intent of the following HTTP request, used to make a REST API call?

PATCH /users/{id | userPrincipalName}

• Create new user

• Update user properties

• Identify user secrets

• Delete user

Answer explanation

Simple API calls are made using HTTP methods, and Microsoft Graph API supports several, including PATCH, which is used to change an entity or update user properties.

Which HTTP method is used to fetch data from Microsoft Graph API?

• PATCH

• POST

• PUT

• GET

Answer explanation

Microsoft Graph API supports the following methods:

• GET: Used to fetch data from Microsoft Graph
• POST: Used to create a new entity
• PUT: Used to modify an entity with existing data (not used a lot in Graph API)
• PATCH: Used to change an entity (note that you only need to specify new or changed information)
• DELETE: Used to remove an entity

Which mailbox access type generates audit events that include each individual email message?

• • Sync

• • WebClient

• • Push

• • Bind

Answer explanation

Bind access is used by IMAP, POP3, and web clients such as Outlook Web Access (OWA). Each email is recorded in the audit log. In rare cases, if more than 1,000 MailItemsAccessed audit records are generated in less than 24 hours, Exchange Online will stop generating auditing records for MailItemsAccessed activity. Sync access is used by Outlook and generates audit events for the mail folder being synced.