CISSP Incident Response and Forensics 2

Question 1

During a forensic investigation, an investigator calculates an MD5 hash of a disk image immediately after acquisition. What is this process called?

Accepted Answer

Hash validation / integrity verification

Answer

Evidence tagging

Answer

Digital signing

Answer

Chain of custody logging

Question 2

Which concept describes the systematic process of identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner?

Accepted Answer

Digital forensics

Answer

Threat intelligence

Answer

Vulnerability assessment

Answer

Risk analysis

Question 3

An organization's IR plan calls for isolating an infected workstation by disabling its network interface. Which containment strategy does this represent?

Accepted Answer

Short-term containment

Answer

Long-term containment

Answer

Eradication

Answer

Recovery

Question 4

What is 'locard's exchange principle' and how does it apply to digital forensics?

Accepted Answer

Every contact leaves a trace — digital actions leave artifacts behind

Answer

Every criminal leaves a digital signature that is unique

Answer

Digital evidence must be encrypted before transfer

Answer

A forensic examiner must never access original evidence directly

Question 5

Which of the following is a primary benefit of having a Computer Security Incident Response Team (CSIRT)?

Accepted Answer

Providing a structured, coordinated response to security incidents

Answer

Eliminating all security vulnerabilities

Answer

Replacing the need for security monitoring tools

Answer

Preventing all malware infections

Question 6

In the context of incident response, what does the term 'dwell time' refer to?

Accepted Answer

The length of time an attacker remains undetected in a network

Answer

The time required to restore systems after eradication

Answer

The duration of the containment phase

Answer

The time between incident discovery and law enforcement notification

Question 7

Which type of malware analysis involves executing a suspicious file in a controlled environment to observe its behavior?

Accepted Answer

Dynamic analysis

Answer

Static analysis

Answer

Code review

Answer

Signature-based analysis