CSX Evidence Collection & Preservation 5

Question 1

Which NIST publication provides a guide to integrating forensic techniques into incident response?

Accepted Answer

NIST SP 800-86

Answer

NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response) specifically addresses forensic methods within the IR process.

Question 2

An examiner is analyzing a Windows system and wants to determine recently opened files. Which artifact provides this information?

Accepted Answer

Jump Lists and LNK files

Answer

Jump Lists and LNK (shortcut) files in Windows record recently accessed files and applications, providing valuable timeline artifacts.

Question 3

What is the difference between logical acquisition and physical acquisition of a mobile device?

Accepted Answer

Logical acquisition is faster but captures only active file system data; physical captures a full bit-for-bit image

Answer

Logical acquisition extracts accessible file system data without a full image, while physical acquisition produces a complete bit-for-bit copy including deleted data.

Question 4

During an incident, a responder powers off a compromised server to 'stop the attack.' What critical evidence is LOST by this action?

Accepted Answer

Volatile memory contents including running processes and network connections

Answer

Powering off a system immediately destroys all volatile memory contents, including running processes, open network connections, and encryption keys held in RAM.

Question 5

Which concept describes the documented sequence of custody, control, transfer, and disposition of evidence?

Accepted Answer

Chain of custody

Answer

Chain of custody is the chronological documentation showing who collected, handled, analyzed, and stored evidence from collection to court presentation.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Evidence Collection & Preservation 5