CISSP Incident Response and Forensics

Question 1

Which phase of the incident response process involves identifying indicators of compromise and determining the scope of an attack?

Accepted Answer

Detection and Analysis

Answer

Containment

Answer

Eradication

Answer

Recovery

Question 2

In digital forensics, what is the primary purpose of maintaining a chain of custody?

Accepted Answer

To ensure evidence integrity and admissibility in court

Answer

To speed up the investigation process

Answer

To encrypt sensitive forensic data

Answer

To allow multiple investigators to modify evidence

Question 3

Which forensic acquisition method produces a bit-for-bit copy of storage media, including deleted files and unallocated space?

Accepted Answer

Physical (raw) acquisition

Answer

Logical acquisition

Answer

Sparse acquisition

Answer

File system acquisition

Question 4

What is the recommended FIRST action when a security analyst discovers an active intrusion on a production server?

Accepted Answer

Contain the incident to prevent further spread

Answer

Immediately power off the server

Answer

Notify law enforcement

Answer

Eradicate the malware

Question 5

Which type of evidence consists of original, unaltered documents or objects that directly prove a fact in an investigation?

Accepted Answer

Best evidence

Answer

Corroborative evidence

Answer

Hearsay evidence

Answer

Circumstantial evidence

Question 6

A forensic investigator uses a write blocker during evidence acquisition. What is the primary reason for this?

Accepted Answer

To prevent any writes to the evidence media that would alter it

Answer

To speed up the imaging process

Answer

To decrypt encrypted drives before imaging

Answer

To compress the forensic image file

Question 7

Which NIST Special Publication provides the primary guidelines for computer security incident handling?

Accepted Answer

NIST SP 800-61

Answer

NIST SP 800-53

Answer

NIST SP 800-137

Answer

NIST SP 800-30