CISSP Incident Response and Forensics 1 — Questions and Answers
Question 1: Which phase of the incident response process involves identifying indicators of compromise and determining the scope of an attack?
- Containment
- Eradication
- Detection and Analysis (Correct answer)
- Recovery
Correct answer: Detection and Analysis
Detection and Analysis is the phase where security teams identify indicators of compromise (IoCs), analyze events, and determine the nature and scope of the incident.
Question 2: In digital forensics, what is the primary purpose of maintaining a chain of custody?
- To speed up the investigation process
- To ensure evidence integrity and admissibility in court (Correct answer)
- To encrypt sensitive forensic data
- To allow multiple investigators to modify evidence
Correct answer: To ensure evidence integrity and admissibility in court
Chain of custody documents every person who handled evidence, ensuring its integrity is preserved and that it remains admissible in legal proceedings.
Question 3: Which forensic acquisition method produces a bit-for-bit copy of storage media, including deleted files and unallocated space?
- Logical acquisition
- Sparse acquisition
- Physical (raw) acquisition (Correct answer)
- File system acquisition
Correct answer: Physical (raw) acquisition
Physical (raw) acquisition creates a sector-by-sector, bit-for-bit image of the entire storage device, capturing all data including deleted files and unallocated space.
Question 4: What is the recommended FIRST action when a security analyst discovers an active intrusion on a production server?
- Immediately power off the server
- Notify law enforcement
- Contain the incident to prevent further spread (Correct answer)
- Eradicate the malware
Correct answer: Contain the incident to prevent further spread
Containment is the first priority to limit the damage and prevent the attacker from spreading further, while preserving evidence and minimizing business impact.
Question 5: Which type of evidence consists of original, unaltered documents or objects that directly prove a fact in an investigation?
- Corroborative evidence
- Best evidence (Correct answer)
- Hearsay evidence
- Circumstantial evidence
Correct answer: Best evidence
Best evidence (also called primary evidence) refers to the original, unaltered document or object; courts prefer it over copies or secondary evidence.
Question 6: A forensic investigator uses a write blocker during evidence acquisition. What is the primary reason for this?
- To speed up the imaging process
- To prevent any writes to the evidence media that would alter it (Correct answer)
- To decrypt encrypted drives before imaging
- To compress the forensic image file
Correct answer: To prevent any writes to the evidence media that would alter it
A write blocker prevents any data from being written to the original evidence media during acquisition, preserving its integrity and ensuring the copy is forensically sound.
Question 7: Which NIST Special Publication provides the primary guidelines for computer security incident handling?
- NIST SP 800-53
- NIST SP 800-61 (Correct answer)
- NIST SP 800-137
- NIST SP 800-30
Correct answer: NIST SP 800-61
NIST SP 800-61, 'Computer Security Incident Handling Guide,' provides guidelines for establishing and operating an incident response capability.
CISSP Incident Response and Forensics 1
Which phase of the incident response process involves identifying indicators of compromise and determining the scope of an attack?