CSX Evidence Collection & Preservation 4

Question 1

What is the correct order when documenting a crime scene under the 'order of volatility' principle?

Accepted Answer

CPU registers → RAM → Network state → Disk

Answer

The order of volatility requires collecting the most ephemeral data first: CPU registers, then RAM, network state, and finally disk.

Question 2

Which technique allows investigators to analyze malware behavior without contaminating the evidence drive?

Accepted Answer

Analyzing the malware in an isolated sandbox environment

Answer

An isolated sandbox environment allows safe malware execution and behavioral analysis without risking contamination of original evidence.

Question 3

An organization must hand over server logs to law enforcement. Which action best protects the organization legally?

Accepted Answer

Provide logs with a chain of custody form and hash values

Answer

Providing logs with a chain of custody form and hash values ensures the evidence is documented and its integrity can be verified.

Question 4

What is 'anti-forensics' and why is it a concern during evidence collection?

Accepted Answer

Techniques used to destroy, obscure, or corrupt digital evidence

Answer

Anti-forensics encompasses techniques like data wiping, steganography, and log tampering used by adversaries to hinder forensic investigations.

Question 5

A forensic examiner discovers timestamps on files have been altered. Which Windows artifact could help determine the original file creation time?

Accepted Answer

$MFT (Master File Table)

Answer

The NTFS $MFT contains multiple timestamp fields including $STANDARD_INFORMATION and $FILE_NAME, which can reveal timestamp manipulation.

(CSX) Cybersecurity Nexus Certification Practice Test