CFE Incident Response and Reporting 2 — Questions and Answers
Question 1: During an incident response engagement, a forensic examiner discovers that volatile memory contains evidence of a running malware process. What is the MOST appropriate first action?
- Immediately power off the system to preserve the hard drive
- Capture a memory dump before taking any other action (Correct answer)
- Run antivirus software to identify and remove the malware
- Disconnect the system from the network and reboot
Correct answer: Capture a memory dump before taking any other action
Volatile memory (RAM) is lost when a system is powered off, so capturing a memory dump must be prioritized before any other action that could destroy this evidence.
Question 2: A CFE is asked to document the chain of custody for digital evidence collected during an incident. Which element is NOT typically required in a chain of custody log?
- Date and time of evidence collection
- Name and signature of each person who handled the evidence
- The monetary value of the evidence (Correct answer)
- Description of the evidence item
Correct answer: The monetary value of the evidence
Chain of custody logs document who handled evidence and when, but the monetary value of the item is not a standard chain of custody requirement.
Question 3: When preparing an incident response report for a non-technical executive audience, which approach is MOST appropriate?
- Include all raw log data and technical artifacts in full detail
- Focus on business impact, risk exposure, and remediation recommendations in plain language (Correct answer)
- Use technical jargon to demonstrate the examiner's expertise
- Limit the report to a single page with bullet points only
Correct answer: Focus on business impact, risk exposure, and remediation recommendations in plain language
Executive reports should translate technical findings into business impact and actionable recommendations that non-technical stakeholders can understand and act upon.
Question 4: An organization suspects an insider threat has been exfiltrating data. During incident response, which log source would MOST directly evidence data exfiltration activity?
- Windows Event Logs for failed login attempts
- Data Loss Prevention (DLP) system logs and proxy logs showing large outbound transfers (Correct answer)
- Antivirus quarantine logs
- Physical access control logs
Correct answer: Data Loss Prevention (DLP) system logs and proxy logs showing large outbound transfers
DLP and proxy logs capture outbound data transfers and can reveal unauthorized exfiltration of sensitive data by insiders.
Question 5: In an incident response timeline, the 'dwell time' refers to:
- The time required to complete forensic analysis after an incident is reported
- The period between initial compromise and detection of a breach (Correct answer)
- The duration of the post-incident review meeting
- The time allowed for evidence collection before a deadline
Correct answer: The period between initial compromise and detection of a breach
Dwell time is the period an attacker remains undetected in a network between initial compromise and discovery, and shorter dwell times reduce breach impact.
Question 6: A forensic examiner finds that system logs on a compromised server have been deleted. What technique can BEST help recover information about the attacker's activities?
- Reviewing the current running processes only
- Examining network flow data, firewall logs, and SIEM records from external sources (Correct answer)
- Asking the system administrator to recreate the logs from memory
- Reinstalling the operating system and reviewing default logs
Correct answer: Examining network flow data, firewall logs, and SIEM records from external sources
When local logs are deleted, external data sources such as network flows, firewall logs, and SIEM records that collected logs before deletion become critical alternate evidence.
Question 7: Which of the following BEST describes the purpose of a 'lessons learned' session after an incident response engagement?
- To assign blame and discipline employees responsible for the incident
- To identify what worked, what failed, and how to improve future response capabilities (Correct answer)
- To finalize billing and close out the engagement contract
- To present findings to law enforcement for prosecution
Correct answer: To identify what worked, what failed, and how to improve future response capabilities
Lessons learned sessions are process improvement exercises that help organizations strengthen their security posture and response procedures based on actual incident experience.
CFE Incident Response and Reporting 2
During an incident response engagement, a forensic examiner discovers that volatile memory contains evidence of a running malware process.
What is the MOST appropriate first action?