Chapter 10: Incident Detection and Analysis

Susan needs to track evidence that has been obtained throughout its life cycle. What documentation does she need to create and maintain if she expects the evidence to be used in a legal case?

• 1. Forensic hashes

• 1. Legal hold

• 1. Chain of custody

• 1. IoC ratings

Answer explanation

Susan needs to track the chain of custody for the evidence and should ensure that a proper chain of custody is maintained. This is especially important when dealing with data that may become part of legal proceedings. Forensic hashes are typically generated as part of forensic processes to ensure that the original and copies of forensic data match, but a hash alone does not provide chain-of-custody tracking. Legal holds require organizations to preserve data but don't track chain of custody, and IoC ratings are unrelated to this question.

Hui wants to comply with a legal hold but knows that her organization has a regular process that purges logs after 45 days due to space limitations. What should she do if the logs are covered by the legal hold?

• 1. Notify counsel that the logs will be deleted automatically in 45 days.

• 1. Delete the logs now to allow longer before space is filled up.

• 1. Identify a preservation method to comply with the hold.

• 1. Make no changes; holds allow ongoing processes to continue as normal.

Answer explanation

Hui knows that she needs to preserve the logs per the legal hold notice and will need to identify a method to preserve the logs while maintaining operations for her organization. Failing to do so can have significant legal repercussions.

Juan wants to validate the integrity of a drive that he has forensically imaged as part of an incident response process. Which of the options should he select?

• 1. Compare a hash of the original drive to the drive image.

• 1. Compare the file size on disk of the original drive to the space taken up by the drive image.

• 1. Compare the vendor's drive size listing to the space taken up by the drive image.

• 1. Use PGP to encrypt the drive and image and make sure that both encrypted versions match.

Answer explanation

Hashes are used to validate drive images and other forensic artifacts. Comparing a hash of the original and the image is commonly used to ensure that they match. None of the other options will validate a drive image, and encrypting a drive will modify it, spoiling the evidence.

Kathleen wants to determine if the traffic she is seeing is unusual for her network. Which of the following options would be most useful to determine if traffic levels are not typical for this time of day in a normal week?

• 1. Heuristics

• 1. Baselines

• 1. Protocol analysis

• 1. Network flow logs

Answer explanation

A baseline for traffic patterns and levels would allow Kathleen to determine if the traffic was typical or if something unusual was going on. Heuristics focus on behaviors, and Kathleen wants to see if traffic levels are different, not behaviors. Protocol analysis looks at whether there is an unusual protocol or data, and network flow logs are useful for determining which systems are sending traffic to where and via what protocol.

Renee wants to adopt an open IoC feed. What issue is Renee most likely to need to address when adopting it?

• 1. The cost of the IoC feed

• 1. The quality of the feed

• 1. The update frequency of the feed

• 1. The level of detail in the feed

Answer explanation

Open feed data can vary in quality and reliability. That means Renee will have to put processes in place to assess the quality and reliability of the IoC information she is receiving. An open feed implies that it is free. Open feeds are generally active, and IoC detail levels vary as IoCs are created and updated, regardless of the type of feed.

Chris wants to use an active monitoring approach to test his network. Which of the following techniques is appropriate?

• 1. Collecting NetFlow data

• 1. Using a protocol analyzer

• 1. Pinging remote systems

• 1. Enabling SNMP

Answer explanation

Active monitoring is focused on reaching out to gather data using tools like ping and iPerf. Passive monitoring using protocol analyzers collects network traffic and router-based monitoring using SNMP, and flows gather data by receiving or collecting logged information.

Which of the following is not information commonly found in an IoC?

• 1. IP addresses

• 1. Domain names

• 1. System images

• 1. Behavior-based information

Answer explanation

System images are not typically part of an IOC. Hashes of malicious software may be, as well as IP addresses, hostnames, domains, and behavior- based information, among other common details.

Cameron wants to be able to detect a denial-of-service attack against his web server. Which of the following tools should he avoid?

• 1. Log analysis

• 1. Flow monitoring

• 1. iPerf

• 1. IPS

Answer explanation

Log analysis, flow monitoring, and deploying an IPS are all appropriate solutions to help detect denial-of-service attacks. iPerf is a performance testing tool used to establish the maximum bandwidth available on a network connection.

Sameer finds log information that indicates that a process that he believes is malicious starts at the same time every day on a Linux system. Where should he start looking for an issue like this?

• 1. He should review the system log.

• 1. He should check the Task Scheduler.

• 1. He should check cron jobs.

• 1. He should check user directories.

Answer explanation

While there could be other issues, a recurring scheduled task is most likely to be set as a cron job, and Sameer should start his search there. The Task Scheduler is a Windows tool, system logs may or may not contain information about the process, and searching user directories would not provide indications of what process was starting at a given time.

Jim uses an IoC feed to help detect new attacks against his organization. What should he do first if his security monitoring system flags a match for an IoC?

• 1. Shut down the system that caused the alert

• 1. Review the alert to determine why it occurred

• 1. Check network logs to identify the remote attacker

• 1. Run a port scan to determine if the system is compromised

Answer explanation

Reviewing why the alert occurred is Jim's first step. IoCs in isolation may not indicate a compromise or attack, so validating the alert is an important first step. shutting down a system due to an alert could cause an outage or prevent forensic investigation. There is nothing in question to indicate that this is a network-based attack that will have been logged, and port scans are also not indicated by the question.