ISP ISP Security Investigations & Incident Response 2

Question 1

Digital forensic investigators use 'write blockers' to:

Accepted Answer

Prevent any data from being written to an original evidence drive during imaging, preserving its integrity

Answer

Write blockers create a one-way barrier so the forensic tool can read the drive without modifying any data on it.

Question 2

In incident response, 'scope creep' during the containment phase refers to:

Accepted Answer

Expanding the investigation to include unrelated systems unnecessarily, prolonging downtime

Answer

Scope creep in containment can take more systems offline than necessary, causing excessive business disruption beyond what the incident warrants.

Question 3

A 'tabletop exercise' in incident response is BEST described as:

Accepted Answer

A discussion-based exercise where participants walk through a scenario to evaluate plans and decision-making

Answer

Tabletop exercises are low-cost, discussion-based sessions that test plans and communication without disrupting operations.

Question 4

Which artifact is MOST useful in reconstructing the timeline of a cyber incident on a Windows system?

Accepted Answer

Windows Event Logs (Security, System, Application)

Answer

Windows Event Logs record system events with timestamps, providing the chronological record investigators need to reconstruct an incident.

Question 5

The 'lessons learned' phase of incident response primarily aims to:

Accepted Answer

Identify what worked, what failed, and how to improve processes and controls to prevent recurrence

Answer

Lessons learned transform incident experience into measurable improvements in security posture, policy, and training.

(ISP) Industrial Security Professional Certification Practice Test