CFE Incident Response and Reporting 3 — Questions and Answers
Question 1: Under the NIST Computer Security Incident Handling Guide (SP 800-61), which phase comes immediately after 'Detection and Analysis'?
- Preparation
- Containment, Eradication, and Recovery (Correct answer)
- Post-Incident Activity
- Evidence Collection
Correct answer: Containment, Eradication, and Recovery
NIST SP 800-61 defines the incident response lifecycle as: Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity.
Question 2: A CFE is examining a phishing incident. The examiner discovers that an employee forwarded a suspicious email to their personal account before reporting it. This action MOST directly concerns which forensic issue?
- Spoliation of evidence and potential contamination of the investigation scope (Correct answer)
- Violation of the organization's vacation policy
- Improvement of the organization's email filtering rules
- Enhancement of the incident response timeline
Correct answer: Spoliation of evidence and potential contamination of the investigation scope
Forwarding the email to a personal account constitutes potential spoliation by moving evidence outside the controlled environment and expanding the scope of compromise.
Question 3: When responding to a ransomware incident, which action should be taken FIRST after confirming the infection?
- Pay the ransom to recover encrypted files immediately
- Isolate affected systems from the network to prevent further spread (Correct answer)
- Reformat all affected hard drives
- Contact the ransomware operator to negotiate
Correct answer: Isolate affected systems from the network to prevent further spread
Network isolation is the immediate containment priority to prevent ransomware from spreading laterally to additional systems and causing greater damage.
Question 4: In incident reporting, the term 'Indicators of Compromise' (IOCs) refers to:
- Financial losses caused by the security incident
- Artifacts and evidence that suggest a system or network has been breached (Correct answer)
- The names of individuals responsible for the incident
- Recommendations for improving security controls
Correct answer: Artifacts and evidence that suggest a system or network has been breached
IOCs are forensic artifacts such as unusual IP addresses, malicious file hashes, or suspicious registry keys that indicate a system has been compromised.
Question 5: A forensic examiner must testify about incident findings in court. Which documentation practice BEST supports the credibility of testimony?
- Relying solely on memory to describe findings without written notes
- Maintaining contemporaneous, detailed notes and logs created at the time of examination (Correct answer)
- Summarizing findings informally in an email to the attorney
- Recreating notes after the fact based on recollection
Correct answer: Maintaining contemporaneous, detailed notes and logs created at the time of examination
Contemporaneous notes created during the examination are more credible than reconstructed records and are better able to withstand cross-examination challenges.
Question 6: Which of the following is the BEST example of a 'short-term containment' strategy during an active incident?
- Rebuilding affected servers from clean backups
- Blocking the attacker's IP address at the firewall while preserving the compromised system for analysis (Correct answer)
- Implementing multi-factor authentication organization-wide
- Conducting a company-wide security awareness training
Correct answer: Blocking the attacker's IP address at the firewall while preserving the compromised system for analysis
Short-term containment focuses on immediate actions like blocking malicious traffic while leaving evidence intact for forensic examination, unlike long-term remediation steps.
Question 7: A CFE discovers that an attacker used legitimate administrative tools (living-off-the-land techniques) during an intrusion. Why does this complicate the investigation?
- Legitimate tools cannot be detected by any means
- Malicious activity blends with normal administrative behavior, making detection and attribution harder (Correct answer)
- Legitimate tools automatically delete all evidence of their use
- Law enforcement cannot prosecute cases involving legitimate tools
Correct answer: Malicious activity blends with normal administrative behavior, making detection and attribution harder
Living-off-the-land techniques exploit trusted tools like PowerShell or WMI, making malicious activity harder to distinguish from routine administrative tasks in logs.
CFE Incident Response and Reporting 3
Under the NIST Computer Security Incident Handling Guide (SP 800-61), which phase comes immediately after 'Detection and Analysis'?