NEW
Font size
WorksheetsInformation Assurance and Security 2 Midterm
Total questions: 46
Worksheet time: 23mins
What is the primary operational function of a Security Operations Center (SOC)?
Developing new internal software and applications.
Monitoring, detection, analysis, and response to cyber threats against the organization.
Managing physical security and access control systems.
Performing compliance and financial audits for external partners.
Which phase of the Incident Response (IR) lifecycle involves proactive planning, establishing an IR team, and performing system hardening before any incident occurs?
Detection
Eradication
Preparation
Recovery
What is the main goal of the Containment phase in the Incident Response lifecycle?
To restore the affected systems to normal operation.
To remove the root cause of the infection (e.g., malware).
To stop the incident from spreading and limit the damage to affected systems.
To conduct a post-mortem review of the incident.
In security operations, what is the key difference between a security event and a security incident?
An incident is always intentional, while an event is always accidental.
An event is any occurrence in the system (e.g., a failed login), while an incident is a confirmed security breach or violation of policy.
An event requires an IR playbook, while an incident does not.
Incidents are always high-severity alerts, while events are always low-severity warnings.
What operational purpose does an Incident Response Playbook serve within the SOC?
To document system vulnerabilities found during a scan.
To standardize the step-by-step process for handling specific, recurring types of security incidents.
To automatically block all incoming network traffic.
To conduct proactive threat hunting operations.
What fundamental principle must a forensic investigator maintain regarding the original source of digital evidence?
Speed: Analyze the data as quickly as possible.
Preservation: The original evidence's integrity must be maintained and never altered.
Efficiency: Only collect the most obviously relevant files.
Confidentiality: Keep the evidence location secret.
Why is a bit-stream image (or forensic image) essential to the forensic process?
It is automatically encrypted using asymmetric cryptography.
It is an exact, sector-by-sector copy of the source media, ensuring that all analysis is performed on a copy, not the original evidence.
It filters out all deleted files, focusing only on active data.
It can be quickly restored to a functional operating system environment.
What specialized hardware tool is used during the acquisition of digital evidence to ensure that no data is written back to the source media by the forensic workstation?
Hash Generator
Write Blocker (or Write Protector)
RAID Controller
Packet Sniffer
What does the Chain of Custody document in the context of digital forensics?
The attacker's motive and identity.
The operating system and hardware configuration of the system.
A documented chronological history of the physical and electronic control of the evidence from collection to final disposition.
A list of all files that have been deleted from the system.
Why is data volatility a key consideration when an investigator is collecting evidence from a running computer system?
Volatile data is always encrypted and hard to read.
Volatile data (like RAM contents) is easily lost or destroyed when the system is powered off or changes state, so it must be collected first.
Volatile data is only found on external hard drives.
Volatile data cannot be used as evidence in court.
What does the acronym MACE stand for when describing the four primary timestamps associated with a file in file system forensics?
Malware, Attack, Correlation, Encryption
Master, Access, Cluster, Execution
Modification, Access, Creation, Entry Modified
Metadata, Allocation, Compression, Extraction
In the NTFS file system (Windows), which critical file system structure stores file metadata and is the primary resource for recovering files that have been logically deleted?
The Boot Sector
The Master File Table (MFT)
The File Allocation Table (FAT)
The Registry
What is the forensic significance of a file having its Modification Time (M) occur before its Access Time (A)?
It indicates the file was manually opened and edited by the user.
It proves the forensic tool is malfunctioning.
It suggests an anomaly, often indicating automated, non-user-driven activity like malware modifying and then staging the file for exfiltration.
It means the file was never opened.
What analysis technique is used to recover files from unallocated or slack space by searching for specific file headers and footers (magic numbers)?
File Hashing
Timeline Analysis
File Carving
Metadata Analysis
Which web browser artifact is most crucial for reconstructing a user's login sessions, site preferences, and tracking their recurring visits across different web pages?
The browser history log
Download lists
Cookies
Browser cache
What is the fundamental difference between Symmetric and Asymmetric encryption in terms of the keys used?
Symmetric uses an infinite number of keys, Asymmetric uses only one.
Symmetric encryption uses one shared secret key for both encryption and decryption, while Asymmetric uses a public key and a private key pair.
Asymmetric encryption is faster and used for bulk data transfer.
Symmetric keys never expire, while Asymmetric keys expire daily.
In the context of a Public Key Infrastructure (PKI), what is the specific role of the Certificate Authority (CA)?
To manage all symmetric keys for the organization.
To develop new encryption standards.
To verify the identity of the certificate owner and issue the digital certificate that securely binds a public key to that identity.
To perform the final encryption of all bulk data.
Which type of encryption is preferred for bulk data encryption (encrypting large files or continuous data streams) due to its superior speed?
Asymmetric encryption
Hashing algorithms
Symmetric encryption
Digital signatures
Besides ensuring data integrity, what key security property does a digital signature provide, meaning the sender cannot later deny sending the message?
Confidentiality
Availability
Non-repudiation
Anonymity
During the TLS handshake (used to establish HTTPS), why does the connection switch from Asymmetric to Symmetric encryption for the main communication channel?
Asymmetric encryption is faster for bulk data transfer.
The switch to faster Symmetric encryption is made to maintain high performance after the secure session key is exchanged.
Symmetric keys are used to verify the server's identity.
Asymmetric keys are required to decrypt the digital signature.
An employee’s laptop shows signs of active ransomware encryption. What is the MOST appropriate immediate containment action?
Begin negotiating with the attacker immediately.
Run a full anti-virus scan on the affected laptop.
Isolate the endpoint by disconnecting it from the network.
Immediately power down the laptop to prevent further encryption.
A system is ready to move from the Eradication phase to the Recovery phase. What is the single most critical action the IR team must confirm before starting recovery?
That all system backups have been completed successfully.
That the system has been patched to the latest operating system version.
That the root cause of the intrusion (e.g., vulnerability or backdoor) has been fully eliminated.
That a new user security awareness training module has been deployed.
When designing the Containment stage of a Malware Infection playbook, what detailed, measurable task should follow the initial network isolation step for forensic purposes?
Immediately re-image the hard drive with a clean operating system.
Create a forensically sound image of the system's volatile memory (RAM).
Change the user's password and disable their network account.
Delete all temporary and recently modified files from the user's profile.
A running server is suspected of hosting a malicious process. Which list represents the correct order of evidence collection, from the most volatile to the least volatile?
Hard Disk Drive -> RAM -> Network Connections -> CPU Cache
CPU Cache/Registers -> RAM -> Hard Disk Drive -> Archived Logs
Archived Logs -> Network Connections -> Hard Disk Drive -> RAM
Hard Disk Drive -> Network Connections -> RAM -> CPU Cache
In the evidence acquisition process, an investigator matches the SHA-256 hash of the original hard drive with the hash of the forensic image. What does matching these two hashes conclusively prove?
That the attacker's identity is now known.
That the Chain of Custody document is complete.
That the forensic image is an identical, unaltered copy of the original evidence source.
That the original hard drive was encrypted.
What is the primary legal and forensic necessity of using a Write Blocker during the collection of non-volatile evidence?
To speed up the bit-stream imaging process.
To automatically generate a Chain of Custody log.
To prevent any modifications or corruption of the original evidence, thereby ensuring its integrity for court admissibility.
To filter out non-essential data before the imaging process begins.
A file exhibits the following MACE timestamps: M=2025-08-01 10:00:00, A=2025-08-01 10:00:00, C=2025-08-01 10:00:00, E=2025-08-01 10:00:00. What is the most likely forensic interpretation of this identical MACE pattern?
The file was accessed and modified over a long period.
The file was opened by a user, read, and then closed manually.
The system clock on the computer was synchronized at that exact moment.
The file was created, modified, and accessed at the exact same moment, suggesting it was newly copied or downloaded with no subsequent activity.
Under what specific circumstance would a forensic analyst be forced to use File Carving to recover a document?
When the document is encrypted and password protected.
When the file's metadata (e.g., the MFT entry or Inode) has been overwritten or corrupted.
When the file is larger than 4GB.
When the analyst does not have administrative privileges on the system.
To prove that an employee executed a malicious script immediately after logging in, what two primary, independent digital artifacts would you extract and correlate using their timestamps?
Firewall Connection Logs and Email Headers.
Browser History and Deleted File Metadata.
System Event Log (Login Time) and a Process Execution Artifact (e.g., Prefetch or ShimCache entry).
Registry Keys and Application Crash Reports.
Why does the TLS protocol employ a hybrid cryptographic approach, using both Asymmetric (RSA/ECC) and Symmetric (AES) encryption during a single secure session?
Symmetric keys are required to verify the server's identity.
Asymmetric encryption is faster for bulk data transfer.
Asymmetric encryption is used for identity verification and key exchange, while Symmetric encryption is used for high-speed bulk data transfer.
The protocol switches to Symmetric encryption only if the connection is slow.
A recipient receives an email with a digital signature that fails verification, even though the recipient knows the sender’s public key is current. What are the two most likely explanations for this failure?
The sender used AES instead of RSA to sign the email, and the certificate expired.
The message was altered after signing, or the sender used the wrong private key to generate the signature.
The recipient’s email client does not support TLS 1.3, or the certificate chain is self-signed.
The sender’s public key was rotated, and the DNS record was cached.
A user's browser displays: "The certificate presented by this website cannot be trusted." Based on PKI principles, what is the most likely reason?
The website is only using Symmetric encryption.
The user's firewall is blocking the secure connection.
The certificate's Certificate Authority (CA) is not included in the browser's list of trusted root CAs, or the certificate has expired/been revoked.
The server is located in a different country than the user.
Which PKI failure best explains a warning that a message may have been altered in transit or signed by an unauthorized private key?
Wrong cipher used or untrusted CA
Private key published on a Certificate Revocation List (CRL)
Email server stripped the digital certificate before delivery
Integrity failure or authentication failure due to a fraudulent private key
An Incident Response team detects an intrusion. Forensic analysis identifies a specific zero-day malicious executable used in the attack. How does this knowledge immediately inform the Containment and Eradication phases?
Switch to Symmetric cryptography for internal communications
Convert the executable’s file hash and network signatures into Indicators of Compromise (IOCs) for rapid, global blocking and targeted network-wide sweeps
Proves the original Chain of Custody was violated and requires restarting the investigation
Automatically completes Recovery by identifying the source code
Scenario: A SIEM alerts that five internal servers are communicating with a known command-and-control (C2) IP. You are in the Containment phase. What is the most effective and appropriate next step?
Immediately delete suspected malicious files from the servers
Isolate the five infected servers from the production network but keep them running for forensic analysis
Begin Recovery by restoring all five servers from last night's backup
Wait to observe attacker actions to learn their full playbook
After resolving a major incident, the IR team meets to discuss the response and notes Detection failed due to poor logging on a key application server. Which IR lifecycle phase includes this meeting?
Eradication
Recovery
Lessons Learned
Preparation
Your organization launches a Threat Hunting program. Which activity best represents a proactive threat hunting approach rather than reactive IR?
Responding to an email gateway phishing alert
Documenting steps to restore a virtual machine
Searching network logs for uncommon data transfer volumes or specific, low-and-slow DNS queries
Patching a known vulnerability found in a recent audit
A workstation is suspected of harboring illegal material. To ensure evidence is admissible in court, which document proves the evidence remained untouched since seizure?
Forensic examination report
Chain of Custody log
System hardware inventory report
Initial incident response playbook
You must acquire a full, bit-for-bit copy of a suspect's running laptop hard drive. Which equipment is essential to ensure data integrity and prevent source contamination?
High-speed network switch
Hardware write-blocker
Power supply unit (PSU)
Memory forensics toolkit
Scenario: An investigator is analyzing a Windows system and observes a file's Modification Time (M) is before its Access Time (A). What is the most common explanation for this anomaly in a malicious context?
The user manually opened the file in a text editor and saved it without making changes.
A system background process automatically updated the file's metadata.
A program (malware) altered the file's content (M) and then a different program (exfiltration script) read the file (A).
The computer's system clock was set incorrectly and was later synchronized to the correct time.
Scenario: An investigator uses File Carving software on the unallocated space of a disk image. What specific forensic information is the software primarily using to recover fragmented files?
The file system's partition table entries.
The MAC address embedded in the file data.
The file's header (magic number) and footer to identify its type and boundaries.
The file's original entry in the Master File Table (MFT).
Scenario: You are correlating events from browser history (User accessed malicious.site), Windows Event Logs (Process bad.exe started), and NTFS MACE times (File bad.exe created). What is the ultimate goal of this Timeline Creation and Correlation process?
To ensure all log files are correctly backed up.
To determine the best network routing path for the exfiltrated data.
To establish a scientifically sound chronological narrative of the intruder’s actions.
To prove the user was responsible for the infection.
Scenario: A developer needs to ensure that only the intended recipient can read a highly confidential message, but the recipient should also be able to prove the sender's identity to a third party. Which combination of cryptographic actions is required?
Symmetric encryption (Confidentiality) and Public Key Infrastructure (Identity).
Asymmetric encryption (Confidentiality) and Digital Signatures (Authentication/Non-Repudiation).
Hashing (Integrity) and Digital Certificates (Authentication).
Symmetric encryption (Confidentiality) and Hashing (Integrity).
Scenario: When establishing a modern VPN connection (using protocols like TLS), the initial step involves the server sending its Public Key, protected by a Digital Certificate. What function does this certificate perform?
It proves that the symmetric encryption key has been securely exchanged.
It ensures data integrity throughout the connection.
It cryptographically verifies the server’s identity to the client using a trusted third party (Certificate Authority).
It authenticates the client's username and password to the network.
Scenario: You need to encrypt a large database file (50GB) for long-term storage (Encryption at Rest). Efficiency and speed are paramount. Which cryptographic method is the most appropriate choice?
Asymmetric encryption (RSA).
Symmetric encryption (e.g., AES-256).
Hashing (SHA-256).
A one-time pad.
Scenario: The Encrypted Exfiltration Proof. An attacker compromises a system and uses a custom tool to symmetrically encrypt a critical database file just before exfiltrating it. The Incident Response team (W5) contained the system moments after the data transfer began. Which single forensic and analytical action provides the strongest integrated evidence proving the timing of the data breach and the integrity of the collected evidence?
Decrypting the database using the attacker's public key (W8) and checking the file's internal content modification date.
Isolating the file's data blocks (W6) and comparing its SHA-256 hash to a hash stored on the firewall log (W5).
Correlating the file's MFT Entry Modified Time (W7) with the SIEM's corresponding Outbound Connection Alert Time (W5), while verifying the forensic image hash (W6).
Searching the browser cache (W7) for the website the attacker used to communicate the symmetric key (W8).
