ACI ACI Network Forensics & Incident Response 2 — Questions and Answers
Question 1: Which FTK Imager option should be used to create a forensically sound image of a live system's network share without powering it down?
- Create Disk Image from physical drive
- Add Evidence Item using a logical evidence file (Correct answer)
- Capture Memory only
- Decrypt Files option
Correct answer: Add Evidence Item using a logical evidence file
Adding a logical evidence item allows FTK Imager to capture files from a live network share without requiring the host system to be shut down.
Question 2: During a network intrusion investigation, what is the significance of identifying a 'beaconing' pattern in firewall logs?
- It indicates normal scheduled update behavior
- It suggests malware is periodically checking in with a C2 server (Correct answer)
- It means the firewall is performing health checks
- It identifies a misconfigured NTP service
Correct answer: It suggests malware is periodically checking in with a C2 server
Beaconing—regular, timed outbound connections—strongly indicates malware performing periodic check-ins with a command-and-control server.
Question 3: An investigator finds encrypted ZIP files on a suspect's machine that were sent over a corporate email server. What should be the first forensic step?
- Delete the files as they cannot be analyzed
- Image the system and preserve the email server logs before attempting decryption (Correct answer)
- Immediately attempt to brute-force the ZIP password
- Notify the suspect to provide the password
Correct answer: Image the system and preserve the email server logs before attempting decryption
Imaging the system and preserving email server logs ensures evidence integrity before any decryption attempts that could alter the evidence state.
Question 4: What is lateral movement in the context of incident response investigations?
- Moving evidence from one storage device to another
- An attacker expanding access from one compromised system to others on the same network (Correct answer)
- Transferring forensic images between investigators
- Rotating analyst assignments during a long investigation
Correct answer: An attacker expanding access from one compromised system to others on the same network
Lateral movement describes how attackers pivot from an initial foothold to additional systems on the internal network to expand their access.
Question 5: Which Windows artifact is most useful for detecting remote desktop protocol (RDP) connections to or from a suspect machine?
- Prefetch files
- Event logs (specifically Event ID 4624/4625 and TerminalServices-RemoteConnectionManager) (Correct answer)
- Browser history
- Recycle Bin artifacts
Correct answer: Event logs (specifically Event ID 4624/4625 and TerminalServices-RemoteConnectionManager)
Windows Event IDs 4624/4625 record logon events, and the TerminalServices-RemoteConnectionManager log specifically records RDP session details.
Question 6: In a corporate incident response scenario, what is the purpose of network segmentation as a containment strategy?
- To speed up network performance for forensic tools
- To isolate compromised systems and prevent lateral spread of an attack (Correct answer)
- To permanently delete infected files automatically
- To archive network logs for long-term storage
Correct answer: To isolate compromised systems and prevent lateral spread of an attack
Network segmentation during containment isolates compromised hosts, limiting the attacker's ability to move laterally to other systems.
ACI ACI Network Forensics & Incident Response 2
Which FTK Imager option should be used to create a forensically sound image of a live system's network share without powering it down?