CFE Incident Response and Reporting 3

Question 1

Under the NIST Computer Security Incident Handling Guide (SP 800-61), which phase comes immediately after 'Detection and Analysis'?

Accepted Answer

Containment, Eradication, and Recovery

Answer

NIST SP 800-61 defines the incident response lifecycle as: Preparation → Detection and Analysis → Containment, Eradication, and Recovery → Post-Incident Activity.

Question 2

A CFE is examining a phishing incident. The examiner discovers that an employee forwarded a suspicious email to their personal account before reporting it. This action MOST directly concerns which forensic issue?

Accepted Answer

Spoliation of evidence and potential contamination of the investigation scope

Answer

Forwarding the email to a personal account constitutes potential spoliation by moving evidence outside the controlled environment and expanding the scope of compromise.

Question 3

When responding to a ransomware incident, which action should be taken FIRST after confirming the infection?

Accepted Answer

Isolate affected systems from the network to prevent further spread

Answer

Network isolation is the immediate containment priority to prevent ransomware from spreading laterally to additional systems and causing greater damage.

Question 4

In incident reporting, the term 'Indicators of Compromise' (IOCs) refers to:

Accepted Answer

Artifacts and evidence that suggest a system or network has been breached

Answer

IOCs are forensic artifacts such as unusual IP addresses, malicious file hashes, or suspicious registry keys that indicate a system has been compromised.

Question 5

A forensic examiner must testify about incident findings in court. Which documentation practice BEST supports the credibility of testimony?

Accepted Answer

Maintaining contemporaneous, detailed notes and logs created at the time of examination

Answer

Contemporaneous notes created during the examination are more credible than reconstructed records and are better able to withstand cross-examination challenges.

(CFE) Certified Forensic Examiner Practice Test

(CFE) Certified Forensic Examiner Practice Test

CFE Incident Response and Reporting 3