CND Incident Response & Disaster Recovery 4

Question 1

Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems?

Accepted Answer

Dynamic analysis (sandboxing)

Answer

Dynamic analysis executes malware in a controlled sandbox environment to observe real-time behaviors such as file creation, registry changes, and network connections.

Question 2

A company's BCP states that critical payroll processing must continue even if the primary data center is destroyed. Which strategy BEST meets this requirement?

Accepted Answer

Hot site with real-time data replication

Answer

A hot site with real-time replication ensures zero data loss and near-instant failover, making it the only option that can sustain critical operations immediately after a site-level disaster.

Question 3

Which evidence collection principle states that the most volatile data must be collected before less volatile data?

Accepted Answer

Order of Volatility

Answer

The Order of Volatility (RFC 3227) dictates collecting data from most volatile (RAM, CPU registers) to least volatile (optical media, paper) to prevent loss of perishable evidence.

Question 4

During incident response, when should an organization notify law enforcement?

Accepted Answer

When the incident involves criminal activity, significant financial loss, or national security implications

Answer

Law enforcement notification is appropriate when incidents involve criminal activity (e.g., ransomware, financial fraud), critical infrastructure, or meet reporting thresholds under applicable laws.

Question 5

What is the primary function of a Security Information and Event Management (SIEM) system in incident response?

Accepted Answer

Aggregating and correlating log data from multiple sources to detect incidents

Answer

A SIEM collects, normalizes, and correlates log and event data from across the environment to detect suspicious patterns and generate alerts for incident responders.

(CND) Certified Network Defender Practice Test

(CND) Certified Network Defender Practice Test

CND Incident Response & Disaster Recovery 4