ISP Security Investigations & Incident Response Flashcards

Digital forensic investigators use 'write blockers' to:

Answer: Prevent any data from being written to an original evidence drive during imaging, preserving its integrity

Write blockers create a one-way barrier so the forensic tool can read the drive without modifying any data on it.

In incident response, 'scope creep' during the containment phase refers to:

Answer: Expanding the investigation to include unrelated systems unnecessarily, prolonging downtime

Scope creep in containment can take more systems offline than necessary, causing excessive business disruption beyond what the incident warrants.

A 'tabletop exercise' in incident response is BEST described as:

Answer: A discussion-based exercise where participants walk through a scenario to evaluate plans and decision-making

Tabletop exercises are low-cost, discussion-based sessions that test plans and communication without disrupting operations.

Which artifact is MOST useful in reconstructing the timeline of a cyber incident on a Windows system?

Answer: Windows Event Logs (Security, System, Application)

Windows Event Logs record system events with timestamps, providing the chronological record investigators need to reconstruct an incident.

The 'lessons learned' phase of incident response primarily aims to:

Answer: Identify what worked, what failed, and how to improve processes and controls to prevent recurrence

Lessons learned transform incident experience into measurable improvements in security posture, policy, and training.

When investigating a suspected theft of trade secrets, which type of specialist should typically be involved?

Answer: Legal counsel with IP and employment law expertise

IP theft investigations have significant legal dimensions requiring attorneys familiar with trade secret law, employment agreements, and evidence handling.