CISSP Incident Response and Forensics 2

Question 1

During a forensic investigation, an investigator calculates an MD5 hash of a disk image immediately after acquisition. What is this process called?

Accepted Answer

Hash validation / integrity verification

Answer

Hashing the evidence immediately after acquisition and then verifying the hash before analysis is called integrity verification, confirming the image has not been altered.

Question 2

Which concept describes the systematic process of identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner?

Accepted Answer

Digital forensics

Answer

Digital forensics is the scientific discipline of identifying, preserving, analyzing, and presenting digital evidence in ways that are legally defensible.

Question 3

An organization's IR plan calls for isolating an infected workstation by disabling its network interface. Which containment strategy does this represent?

Accepted Answer

Short-term containment

Answer

Short-term containment involves immediate actions like disabling a network interface to stop the spread of an incident while longer-term solutions are prepared.

Question 4

What is 'locard's exchange principle' and how does it apply to digital forensics?

Accepted Answer

Every contact leaves a trace — digital actions leave artifacts behind

Answer

Locard's Exchange Principle states that every contact leaves a trace; in digital forensics, this means that whenever someone interacts with a system, artifacts such as logs and registry entries are left behind.

Question 5

Which of the following is a primary benefit of having a Computer Security Incident Response Team (CSIRT)?

Accepted Answer

Providing a structured, coordinated response to security incidents

Answer

A CSIRT provides an organized, expert team that can respond quickly and effectively to incidents, minimizing damage and recovery time through coordinated effort.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Incident Response and Forensics 2