CISSP Incident Response and Forensics

Question 1

Which phase of the incident response process involves identifying indicators of compromise and determining the scope of an attack?

Accepted Answer

Detection and Analysis

Answer

Detection and Analysis is the phase where security teams identify indicators of compromise (IoCs), analyze events, and determine the nature and scope of the incident.

Question 2

In digital forensics, what is the primary purpose of maintaining a chain of custody?

Accepted Answer

To ensure evidence integrity and admissibility in court

Answer

Chain of custody documents every person who handled evidence, ensuring its integrity is preserved and that it remains admissible in legal proceedings.

Question 3

Which forensic acquisition method produces a bit-for-bit copy of storage media, including deleted files and unallocated space?

Accepted Answer

Physical (raw) acquisition

Answer

Physical (raw) acquisition creates a sector-by-sector, bit-for-bit image of the entire storage device, capturing all data including deleted files and unallocated space.

Question 4

What is the recommended FIRST action when a security analyst discovers an active intrusion on a production server?

Accepted Answer

Contain the incident to prevent further spread

Answer

Containment is the first priority to limit the damage and prevent the attacker from spreading further, while preserving evidence and minimizing business impact.

Question 5

Which type of evidence consists of original, unaltered documents or objects that directly prove a fact in an investigation?

Accepted Answer

Best evidence

Answer

Best evidence (also called primary evidence) refers to the original, unaltered document or object; courts prefer it over copies or secondary evidence.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Incident Response and Forensics