ACI ACI Network Forensics & Incident Response 2

Question 1

Which FTK Imager option should be used to create a forensically sound image of a live system's network share without powering it down?

Accepted Answer

Add Evidence Item using a logical evidence file

Answer

Adding a logical evidence item allows FTK Imager to capture files from a live network share without requiring the host system to be shut down.

Question 2

During a network intrusion investigation, what is the significance of identifying a 'beaconing' pattern in firewall logs?

Accepted Answer

It suggests malware is periodically checking in with a C2 server

Answer

Beaconing—regular, timed outbound connections—strongly indicates malware performing periodic check-ins with a command-and-control server.

Question 3

An investigator finds encrypted ZIP files on a suspect's machine that were sent over a corporate email server. What should be the first forensic step?

Accepted Answer

Image the system and preserve the email server logs before attempting decryption

Answer

Imaging the system and preserving email server logs ensures evidence integrity before any decryption attempts that could alter the evidence state.

Question 4

What is lateral movement in the context of incident response investigations?

Accepted Answer

An attacker expanding access from one compromised system to others on the same network

Answer

Lateral movement describes how attackers pivot from an initial foothold to additional systems on the internal network to expand their access.

Question 5

Which Windows artifact is most useful for detecting remote desktop protocol (RDP) connections to or from a suspect machine?

Accepted Answer

Event logs (specifically Event ID 4624/4625 and TerminalServices-RemoteConnectionManager)

Answer

Windows Event IDs 4624/4625 record logon events, and the TerminalServices-RemoteConnectionManager log specifically records RDP session details.

(ACI) AccessData Certified Investigator Practice Test

(ACI) AccessData Certified Investigator Practice Test

ACI ACI Network Forensics & Incident Response 2