CND Incident Response & Disaster Recovery 4 — Questions and Answers
Question 1: Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems?
- Static analysis
- Code review
- Dynamic analysis (sandboxing) (Correct answer)
- Signature scanning
Correct answer: Dynamic analysis (sandboxing)
Dynamic analysis executes malware in a controlled sandbox environment to observe real-time behaviors such as file creation, registry changes, and network connections.
Question 2: A company's BCP states that critical payroll processing must continue even if the primary data center is destroyed. Which strategy BEST meets this requirement?
- Weekly tape backups stored offsite
- Hot site with real-time data replication (Correct answer)
- Cold site provisioned within 72 hours
- Manual processing using paper records
Correct answer: Hot site with real-time data replication
A hot site with real-time replication ensures zero data loss and near-instant failover, making it the only option that can sustain critical operations immediately after a site-level disaster.
Question 3: Which evidence collection principle states that the most volatile data must be collected before less volatile data?
- Locard's Exchange Principle
- Order of Volatility (Correct answer)
- Chain of Custody
- Least Privilege Evidence Handling
Correct answer: Order of Volatility
The Order of Volatility (RFC 3227) dictates collecting data from most volatile (RAM, CPU registers) to least volatile (optical media, paper) to prevent loss of perishable evidence.
Question 4: During incident response, when should an organization notify law enforcement?
- Only after the incident is fully remediated
- Only if the incident involves physical theft of hardware
- When the incident involves criminal activity, significant financial loss, or national security implications (Correct answer)
- Law enforcement should never be involved in cyber incidents
Correct answer: When the incident involves criminal activity, significant financial loss, or national security implications
Law enforcement notification is appropriate when incidents involve criminal activity (e.g., ransomware, financial fraud), critical infrastructure, or meet reporting thresholds under applicable laws.
Question 5: What is the primary function of a Security Information and Event Management (SIEM) system in incident response?
- Blocking malware before it executes on endpoints
- Aggregating and correlating log data from multiple sources to detect incidents (Correct answer)
- Encrypting sensitive data at rest across the enterprise
- Performing automated vulnerability scans on all network devices
Correct answer: Aggregating and correlating log data from multiple sources to detect incidents
A SIEM collects, normalizes, and correlates log and event data from across the environment to detect suspicious patterns and generate alerts for incident responders.
Question 6: A ransomware attack has encrypted files on 200 workstations. According to IR best practices, what should the team do IMMEDIATELY after detection?
- Pay the ransom to restore operations quickly
- Disconnect affected systems from the network to prevent further spread (Correct answer)
- Reimage all 200 workstations simultaneously
- Notify all employees about the attack via company email
Correct answer: Disconnect affected systems from the network to prevent further spread
Immediate network isolation stops ransomware from spreading laterally to additional systems, limiting the blast radius before eradication and recovery begin.
Question 7: Which disaster recovery test method involves actually switching production operations to the backup site to verify full functionality?
- Tabletop exercise
- Checklist review
- Simulation drill
- Full interruption test (Correct answer)
Correct answer: Full interruption test
A full interruption test (also called a full-scale test) actually cuts over production to the backup site, providing the most realistic validation but carrying the highest operational risk.
CND Incident Response & Disaster Recovery 4
Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems?