ISP ISP Security Investigations & Incident Response 2

Question 1

Digital forensic investigators use 'write blockers' to:

Accepted Answer

Prevent any data from being written to an original evidence drive during imaging, preserving its integrity

Answer

Encrypt evidence drives before analysis

Answer

Block malware from writing to the investigator's workstation

Answer

Speed up the forensic imaging process

Question 2

In incident response, 'scope creep' during the containment phase refers to:

Accepted Answer

Expanding the investigation to include unrelated systems unnecessarily, prolonging downtime

Answer

Adding additional security analysts to speed up the investigation

Answer

Increasing the severity rating of an incident after new evidence is found

Answer

Documenting more detail than required in the incident report

Question 3

A 'tabletop exercise' in incident response is BEST described as:

Accepted Answer

A discussion-based exercise where participants walk through a scenario to evaluate plans and decision-making

Answer

A live simulation where physical intrusion attempts are made on the facility

Answer

A performance review of the security team's annual metrics

Answer

An unannounced drill designed to test employee reaction without prior notice

Question 4

Which artifact is MOST useful in reconstructing the timeline of a cyber incident on a Windows system?

Accepted Answer

Windows Event Logs (Security, System, Application)

Answer

Browser bookmarks folder

Answer

Desktop wallpaper settings

Answer

Printer queue history

Question 5

The 'lessons learned' phase of incident response primarily aims to:

Accepted Answer

Identify what worked, what failed, and how to improve processes and controls to prevent recurrence

Answer

Assign blame and initiate disciplinary actions against responsible personnel

Answer

Archive the incident report and close the ticket permanently

Answer

Notify external media about the security breach

Question 6

When investigating a suspected theft of trade secrets, which type of specialist should typically be involved?

Accepted Answer

Legal counsel with IP and employment law expertise

Answer

Marketing analyst

Answer

Customer service manager

Answer

Payroll administrator