CySA Review 7 & 8

George gathered forensics from a recent intrusion in preparation for legal proceedings. He used EnCase to gather the digital forensics, cloned the hard drive, and took the hard drive home for further analysis. Which of the following did he violate?

• Clone procedures

• Chain of Command

• Chain of Custody

• Hashing procedures

George identified 3 Mycc computers that are infected with malware and Windows Defender was unable to detect it. Where is the BEST place to acquire evidence to perform data carving?

• Registry

• Hard Drive

• Memory

• Control panel

What would you use to verify that a disk image you created has not been altered

• Nessus

• Hash

• TPM

• MD2020

Which four phases outline the procedures involved in a forensics investigation? (select four)

• Identification

• Collection

• Verifying

• Analysis

• Reporting

To preserve evidence of a temporary file system mounted to a host, which system device must you target for evidence collection?

• RAM

• HDD

• SSD

• USB

During an incident response, George obtained evidence from the hard drive of a hacked server. What should he do to ensure the data integrity of the evidence?

• Complete Chain of Custody doc

• Create hashes for each file on the drive

• Encrypt it with AES

• Don’t worry about it

What is the first thing that needs to be done when starting an investigation into a cyber security event?

• Cry

• Secure crime scene

• Interview witnesses

• Call the police

Process of extracting data (file) out of undifferentiated blocks (raw data)

• Carving

• Extracting

• Enumeration

• Exfiltration

George has been alerted to several emails that show evidence an employee is planning malicious activities that involve employee PII on the network before leaving the organization. George's BEST response would be to coordinate with the legal department and:

• The police

• HR

• PR

• Nobody

Which of the following would MOST likely be included in the incident response procedure after a security breach of customer PII?

• Marketing

• HR

• PR

• SOC