SY0-601 Operations & Incident Response 2

Question 1

During a forensic investigation, an analyst needs to preserve evidence from a compromised system. Which action should be performed FIRST?

Accepted Answer

Capture a memory dump before powering off

Answer

Memory is volatile and will be lost on power-off, so capturing a RAM dump first preserves critical evidence like running processes and encryption keys.

Question 2

Which NIST incident response phase focuses on limiting the damage after a security incident is confirmed?

Accepted Answer

Containment, Eradication, and Recovery

Answer

The Containment, Eradication, and Recovery phase is where responders limit damage, remove threats, and restore systems.

Question 3

A security analyst observes repeated failed SSH login attempts from a single IP address. What type of attack is most likely occurring?

Accepted Answer

Brute force

Answer

Repeated failed login attempts from one source are characteristic of a brute force attack trying to guess credentials.

Question 4

Which tool is BEST suited for capturing and analyzing network packets during an incident?

Accepted Answer

Wireshark

Answer

Wireshark is a packet capture and protocol analyzer used to inspect network traffic in real time or from saved captures.

Question 5

What does the term 'chain of custody' mean in digital forensics?

Accepted Answer

Documentation tracking who handled evidence and when

Answer

Chain of custody is a documented record showing who collected, handled, transferred, and analyzed evidence to ensure its integrity in legal proceedings.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Operations & Incident Response 2