I85PREP
⌘ K
ECIH study materials
ECIH study resources

ECIH practice questions

One question at a time. Build your ECIH understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to Incident Handling and Response

Which statement best distinguishes a security event from a security incident?

  1. An event requires a ticket in the ITSM tool; an incident requires a report to a regulator.
  2. An event is any observable occurrence; an incident harms or threatens confidentiality, integrity or availability. Correct answer.
  3. An event is always malicious in nature; an incident is an event that law enforcement has formally confirmed and opened a case for.
  4. Events are recorded only by network sensors; incidents are recorded only by host-based logging tools.

Explanation

An event is any observable occurrence in a system or network, such as a user logging in or a firewall dropping a packet. It becomes an incident when it actually or potentially threatens confidentiality, integrity or availability, or violates security policy. Most events are benign, and neither law enforcement confirmation nor a ticket is part of the definition.

Question 2Introduction to Incident Handling and Response

In the NIST SP 800-61 incident response life cycle, which phase immediately follows Detection and Analysis?

  1. Containment, Eradication and Recovery Correct answer.
  2. Preparation
  3. Lessons Learned and Reporting
  4. Post-Incident Activity

Explanation

The NIST SP 800-61 life cycle runs Preparation, Detection and Analysis, Containment/Eradication/Recovery, then Post-Incident Activity. Once an incident is detected and understood, the team acts to limit spread, remove the cause and restore service. Lessons learned is part of the final post-incident phase rather than a separate step in the model.

Question 3Introduction to Incident Handling and Response

What is the primary purpose of the preparation phase of incident response?

  1. To restore affected services to normal operation as quickly as possible.
  2. To build the capability to respond before an incident occurs, through policy, tools, people and training. Correct answer.
  3. To isolate compromised hosts from the production network.
  4. To identify the root cause of an incident and document it for legal proceedings.

Explanation

Preparation establishes the capability to respond: policy, plans, team structure, communications, tooling, forensic readiness and training. Root-cause analysis, restoration and isolation are all actions that occur after an incident has been detected. Without preparation the later phases are improvised and slower.

Question 4Introduction to Incident Handling and Response

Which of the following is the primary goal of incident response?

  1. Identifying and punishing the individuals who carried out the attack.
  2. Collecting evidence sufficient to support a criminal prosecution in every single case.
  3. Keeping the incident out of public disclosure to protect the brand.
  4. Containing damage, restoring services and preserving evidence for later analysis. Correct answer.

Explanation

Incident response aims to limit harm, return to normal operations in a controlled way and retain evidence so that cause and scope can be established. Prosecution and public disclosure are optional outcomes that depend on legal and business decisions. Attribution and punishment are not the responsibility of the response team.

Question 5Introduction to Incident Handling and Response

A flood of SYN packets from thousands of compromised hosts exhausts a web server's connection table, so legitimate users cannot connect. Which incident category best describes this?

  1. Denial of service Correct answer.
  2. Malicious code
  3. Unauthorized access
  4. Improper usage

Explanation

Denial-of-service incidents degrade or block availability of a service, here by exhausting connection state with half-open SYN requests. Unauthorized access involves gaining entry to systems or data without permission. Malicious code concerns viruses, worms, trojans and similar programs, while improper usage concerns policy violations by authorized users.

Question 6Introduction to Incident Handling and Response

A first responder confirms that a workstation is infected with malware. What is the most appropriate first action?

  1. Follow the documented incident procedure and notify the incident response team. Correct answer.
  2. Email the observed indicators to all staff so they can watch for them.
  3. Run a full antivirus scan and delete every detected file on the workstation.
  4. Power off the workstation immediately so that the malware cannot spread to other hosts.

Explanation

A first responder's role is to follow the established procedure and hand off to the incident response team with information intact. Abrupt power-off destroys volatile evidence such as memory and network connections, while deleting files or broadcasting unverified indicators creates additional risk. Coordinated handling preserves both containment options and evidence.

Question 7Introduction to Incident Handling and Response

An incident response team has several open incidents and must decide what to work on first. Which basis is most appropriate for triage?

  1. The job title or seniority of the employee who reported each incident.
  2. The number of correlated alerts each incident generated in the SIEM console.
  3. The order in which the incidents were reported to the service desk.
  4. Business impact and severity, based on affected data and service criticality. Correct answer.

Explanation

Triage ranks incidents by potential harm to the business, considering data sensitivity, service criticality and scope. Arrival order and reporter seniority are process or political signals rather than measures of harm. Alert volume is an indicator of noise as often as of severity.

Question 8Introduction to Incident Handling and Response

A self-propagating worm is spreading rapidly across a flat internal network. Which containment approach is generally preferred when the priority is to stop propagation quickly?

  1. Power off all servers immediately, because a clean shutdown preserves memory contents.
  2. Monitor only, because containment actions destroy forensic evidence on hosts.
  3. Wait for an updated signature so that only confirmed infected hosts are blocked.
  4. Segment the affected network areas to cut propagation paths before hosts are cleaned. Correct answer.

Explanation

When propagation is fast, the spread path must be severed before individual hosts can be remediated, which usually means network segmentation or isolation. Pure monitoring is chosen only when the risk of tipping off an intruder outweighs spread, which is not the case with a fast worm. Cleaning and signature-based blocking operate too slowly once the infection rate is high.

Question 9Introduction to Incident Handling and Response

When collecting volatile evidence from a running server, which item should be acquired first?

  1. Backups held on the enterprise backup server.
  2. Application log files stored on the local disk.
  3. Contents of RAM and the running process table. Correct answer.
  4. Configuration files in the system directories on the local disk.

Explanation

Collection follows the order of volatility: CPU registers and cache, memory, network state and running processes, then disk contents, then remote logs and archival backups. Memory and process information disappear at shutdown or reboot and therefore come first. Disk files and backups persist and can be collected later.

Question 10Introduction to Incident Handling and Response

What is the main purpose of maintaining a chain-of-custody record for digital evidence?

  1. To prove that the evidence was examined by a certified forensic analyst.
  2. To record the business impact of the incident for management reporting.
  3. To encrypt the evidence so that unauthorized parties cannot read its contents.
  4. To log each transfer and access so the evidence's integrity can be demonstrated. Correct answer.

Explanation

Chain of custody documents who handled the evidence, when, where and why, creating an auditable history that supports admissibility and credibility. It does not certify the examiner's qualifications, provide encryption, or measure business impact. Gaps or unexplained access weaken the evidence's value in any later proceeding.

Question 11Introduction to Incident Handling and Response

Which outcome best shows that a post-incident lessons-learned review was effective?

  1. The incident ticket was closed within the agreed service-level target.
  2. The attacker's tools were added to the antivirus signature database.
  3. The team documented the full timeline of the incident in the final report.
  4. Owned, specific improvements to procedures or controls were identified and tracked. Correct answer.

Explanation

The value of a lessons-learned review lies in producing concrete, assigned changes that reduce the likelihood or impact of recurrence, with follow-up until complete. Closing tickets, updating signatures and writing timelines are useful outputs but do not by themselves change future capability. Tracking ownership and completion is what converts findings into improvement.

Question 12Introduction to Incident Handling and Response

When should an analyst escalate an incident to a higher tier or to management?

  1. At the end of every analyst shift, regardless of the incident severity or impact.
  2. When predefined severity thresholds are met or the analyst lacks the skill to proceed. Correct answer.
  3. Only after the root cause of the incident has been fully determined and documented.
  4. Only when law enforcement has been contacted and a case number has been issued.

Explanation

Escalation criteria are defined in advance and usually combine severity or impact thresholds with triggers such as legal, regulatory or executive involvement. An analyst also escalates when the incident exceeds their authority or technical capability. Waiting for full root cause delays response, and arbitrary shift-based escalation is unrelated to risk.

Question 13Introduction to Incident Handling and Response

Which practice best supports timely, reliable exchange of indicators between an organization and its trusted peers?

  1. Exchanging indicators in a machine-readable format such as STIX over TAXII. Correct answer.
  2. Posting indicators to a public social media channel as soon as they are found.
  3. Keeping indicators in a local spreadsheet that only the IR team can read.
  4. Sending indicators as screenshots in an email distribution list to peers.

Explanation

Structured, machine-readable formats and transport protocols let indicators be ingested automatically and consistently across organizations. Screenshots and spreadsheets require manual transcription, which is slow and error-prone, and a local-only store shares nothing. Public posting also risks leaking victim information and tipping off an adversary.

Question 14Introduction to Incident Handling and Response

A SOC measures a mean time to detect (MTTD) of 40 hours and a mean time to respond (MTTR) of 6 hours. Which change most directly targets the MTTD figure?

  1. Shortening the post-incident report template used by the team.
  2. Automating host isolation as soon as an incident has been formally confirmed.
  3. Adding detection coverage and tuning alerts so malicious activity surfaces sooner. Correct answer.
  4. Adding more analysts to the on-call response rotation.

Explanation

Mean time to detect measures the interval between compromise and discovery, so it is improved by better sensor coverage, correlation and alert quality. Additional analysts, isolation automation and reporting changes affect response speed or documentation rather than discovery. Detection engineering is therefore the lever for MTTD.

Question 15Introduction to Incident Handling and Response

Which measure is the clearest example of forensic readiness established before an incident occurs?

  1. Taking a full disk image of every server after an intrusion is confirmed.
  2. Enabling centralized, time-synchronized logging with defined retention periods. Correct answer.
  3. Hiring an external forensic firm on the day the breach is discovered.
  4. Interviewing employees about their whereabouts during the incident.

Explanation

Forensic readiness means having the evidence sources, time synchronization, retention and procedures in place before they are needed. Centralized, synchronized logging with known retention is a classic pre-incident control. Imaging, interviewing and engaging a firm are actions taken after the incident and depend on data that should already exist.

Question 16Introduction to Incident Handling and Response

An investigation confirms a breach involving customer personal data. What should the incident response plan require at this point?

  1. Publishing technical indicators to all customers before containment is achieved.
  2. Notifying legal, executive and regulatory contacts via pre-agreed channels. Correct answer.
  3. Deleting the affected logs to avoid them being disclosed later.
  4. Waiting until the full root cause is known before informing anyone internally.

Explanation

Communication plans specify who is notified, by whom, through which channel and within what timeframe, and legal or regulatory duties usually start once personal data is known to be affected. Early internal notification of legal and executive stakeholders enables obligation assessment. Deleting logs or delaying all notice increases legal exposure, and premature public disclosure of indicators can compromise the investigation.

Question 17Introduction to Incident Handling and Response

Which statement correctly contrasts NIST SP 800-61 with ISO/IEC 27035?

  1. ISO/IEC 27035 applies only to cloud providers, while NIST SP 800-61 applies only to government agencies.
  2. NIST SP 800-61 is US federal guidance; ISO/IEC 27035 is an international standard, each defining a response life cycle. Correct answer.
  3. Both documents define identical phase names and differ only in formatting and publication year.
  4. NIST SP 800-61 is an international certification standard, while ISO/IEC 27035 is US federal guidance for agencies.

Explanation

NIST SP 800-61 is guidance published by the US National Institute of Standards and Technology and is widely adopted beyond government, while ISO/IEC 27035 is a multi-part international standard on incident management. Each describes a life cycle or process set, but their structure and terminology are not identical. Neither is an exclusive certification scheme tied to a single sector.

Question 18Introduction to Incident Handling and Response

After containing an intrusion on a file server, the team rebuilds the operating system from a trusted image, patches the exploited vulnerability and resets credentials, then returns the server to production. Which phases do these actions represent?

  1. Detection and analysis, followed by eradication.
  2. Containment, followed by preparation.
  3. Eradication, followed by recovery. Correct answer.
  4. Recovery, followed by post-incident activity.

Explanation

Eradication removes the cause of the incident, such as the malicious code, the exploited vulnerability and compromised credentials. Recovery returns the system to a known-good, monitored production state. Containment already happened, and post-incident activity comes after recovery is confirmed stable.

Question 19Introduction to Incident Handling and Response

Which statement about acquiring volatile evidence from a live compromised host is most accurate?

  1. Live acquisition is unnecessary when the host's disk is encrypted with full-disk encryption.
  2. Live acquisition modifies system state, so each action and its order must be documented. Correct answer.
  3. Live acquisition should always be performed after the disk is imaged, to avoid altering artefacts.
  4. Live acquisition has no effect on evidence integrity, because the tools only read data from the host.

Explanation

Any interaction with a running system changes it, for example by loading tools, altering timestamps or overwriting memory, so the examiner must record what was run and in what order to keep the evidence defensible. Volatile data also disappears on shutdown, which is why memory is often collected before disks when that trade-off is accepted. Full-disk encryption does not make memory or network state irrelevant.

Question 20Introduction to Incident Handling and Response

A ransomware outbreak encrypts file shares in three departments and takes the ERP system offline. From an incident-management standpoint, what marks this out from a routine incident?

  1. It must be handled by the SOC alone, without involving business unit owners.
  2. It automatically becomes a crime scene that must be left untouched until police arrive.
  3. It requires only a lessons-learned review, because technical containment is complete.
  4. Its impact exceeds defined thresholds, triggering business continuity and crisis management. Correct answer.

Explanation

Major incidents are those whose impact crosses predefined thresholds, requiring coordination beyond the technical team, such as crisis management, business continuity and executive decision-making. Response still includes technical containment, but it is no longer sufficient on its own. Preservation of evidence is important yet does not require abandoning all recovery activity pending police arrival.

Question 21Incident Handling and Response Process

Which sequence correctly represents the incident response lifecycle?

  1. Preparation, detection, containment, eradication, recovery, lessons learned Correct answer.
  2. Containment, detection, preparation, eradication, recovery, lessons learned
  3. Detection, preparation, recovery, containment, eradication, lessons learned
  4. Preparation, containment, detection, eradication, lessons learned, recovery

Explanation

The lifecycle begins with preparation, moves through detection and analysis, containment, eradication, and recovery, and closes with post-incident activity such as lessons learned. Each phase consumes the output of the one before it, so reordering the phases breaks the feedback loop between detection, containment, and improvement.

Question 22Incident Handling and Response Process

An analyst receives an alert about suspected malware on a user's workstation. What is the most appropriate first action?

  1. Notify regulators of a potential data breach
  2. Immediately reimage the workstation to remove the malware
  3. Validate the alert and confirm whether a real incident occurred Correct answer.
  4. Shut down the workstation to stop further damage

Explanation

Analysis must confirm that an alert represents a genuine incident before costly or destructive actions are taken. Reimaging or powering down a machine destroys volatile evidence and may be wasted effort if the alert proves to be a false positive. Regulatory notification follows confirmation of a reportable event, not a raw alert.

Question 23Incident Handling and Response Process

What is the primary objective of the containment phase?

  1. Limit the incident's scope and preserve evidence Correct answer.
  2. Restore affected systems to normal production use
  3. Document lessons learned for future incidents
  4. Remove the root cause of the incident

Explanation

Containment stops the spread of an incident while keeping evidence and business operations intact. Restoration belongs to recovery, root cause removal to eradication, and improvement to post-incident activity.

Question 24Incident Handling and Response Process

Which record demonstrates that evidence has been continuously accounted for from collection to presentation?

  1. A chain-of-custody form Correct answer.
  2. A firewall change ticket
  3. An incident timeline
  4. A vulnerability scan report

Explanation

A chain-of-custody record documents who handled evidence, when, and for what purpose, proving continuous accountability. Without it, evidence may be challenged as tampered with or poorly controlled.

Question 25Incident Handling and Response Process

Which activity best characterizes the lessons-learned phase?

  1. Reviewing response effectiveness and updating playbooks Correct answer.
  2. Blocking attacker IPs at the perimeter firewall
  3. Escalating the incident to senior management
  4. Rebuilding compromised servers from a known good image

Explanation

Post-incident review measures how well the response performed and translates findings into updated procedures, controls, and training. Rebuilding systems and blocking addresses are operational response actions that occur earlier in the lifecycle.

Question 26Incident Handling and Response Process

Which activity belongs to the preparation phase of incident response?

  1. Eradicating malware from affected endpoints
  2. Isolating an infected host from the network
  3. Performing a root cause analysis
  4. Building playbooks and training responders Correct answer.

Explanation

Preparation establishes capability before an incident occurs: policies, playbooks, tooling, communication plans, and trained personnel. Isolation, eradication, and root cause analysis are executed during live handling and post-incident review.

Question 27Incident Handling and Response Process

Which activity is performed during the identification phase of incident response?

  1. Conducting a post-mortem meeting
  2. Applying patches to the exploited service
  3. Verifying alerts and determining incident scope Correct answer.
  4. Restoring data from backups

Explanation

Identification, also called detection and analysis, covers validating alerts, scoping the incident, and determining what has been affected. Patching, restoring, and post-mortems belong to eradication, recovery, and post-incident activity respectively.

Question 28Incident Handling and Response Process

A responder must collect the most volatile evidence first. Which order runs from most volatile to least volatile?

  1. Swap file, RAM, network connections, backup tapes
  2. Network connections, RAM, swap file, backup tapes Correct answer.
  3. Backup tapes, RAM, swap file, network connections
  4. Network connections, backup tapes, RAM, swap file

Explanation

Volatility ordering places live network state and memory ahead of on-disk structures such as swap files, and places archival media last. Capturing in this order preserves data that would otherwise be lost when the system changes state or is powered down.

Question 29Incident Handling and Response Process

Which action belongs to the eradication phase?

  1. Restoring systems from clean backups
  2. Interviewing users about the incident
  3. Removing malware and patching the exploited flaw Correct answer.
  4. Blocking malicious traffic at the firewall

Explanation

Eradication removes the malicious components and closes the vulnerability that allowed the compromise, so the threat cannot persist. Blocking traffic is containment, restoration is recovery, and interviews support analysis.

Question 30Incident Handling and Response Process

Which condition best indicates that the recovery phase is complete?

  1. The attacker's infrastructure has been blocked
  2. The containment plan has been approved
  3. The incident ticket has been closed by the analyst
  4. Systems are restored and verified as trustworthy Correct answer.

Explanation

Recovery ends when systems are restored, validated through testing and monitoring, and returned to normal operation. Blocking attacker infrastructure and approving a containment plan are earlier steps, and ticket closure is administrative.

Question 31Incident Handling and Response Process

Which factor most strongly justifies escalating an incident to senior management?

  1. The alert came from an endpoint detection tool
  2. The affected user is currently on leave
  3. The incident affects critical business services Correct answer.
  4. The incident was detected after business hours

Explanation

Escalation criteria typically hinge on business impact, scope, data sensitivity, and regulatory exposure. Disruption to critical services requires management decisions about resources, communications, and continuity.

Question 32Incident Handling and Response Process

What is the primary purpose of calculating a cryptographic hash of a forensic disk image?

  1. To encrypt the contents against disclosure
  2. To speed up the acquisition process
  3. To compress the image for storage
  4. To demonstrate the image was not altered Correct answer.

Explanation

A hash acts as a digital fingerprint; recomputing it later and matching the original value shows the image has not changed since acquisition. It does not compress, encrypt, or accelerate the imaging process.

Question 33Incident Handling and Response Process

Why does an incident response team maintain a jump kit?

  1. To replace the organization's backup strategy
  2. To store completed case files for archival
  3. To satisfy licensing requirements for forensic software
  4. To have essential tools ready for immediate deployment Correct answer.

Explanation

A jump kit pre-stages forensic tools, write blockers, media, documentation, and communication equipment so responders can begin work without delay. It is neither an archive nor a substitute for backup and licensing controls.

Question 34Incident Handling and Response Process

When selecting a containment strategy for a compromised server, which consideration matters most?

  1. The length of the incident ticket description
  2. The number of tools in the responder's jump kit
  3. The attacker's preferred attack tactic
  4. Balance between halting spread and preserving data Correct answer.

Explanation

Containment choices weigh stopping propagation against preserving evidence, maintaining business continuity, and the value of the affected asset. The selected strategy is documented and approved by the appropriate authority.

Question 35Incident Handling and Response Process

A team eradicates malware from a server, but the same infection reappears within a week. Which failure in the response process is most likely?

  1. The recovery phase used verified clean backups
  2. The lessons-learned meeting was scheduled too early
  3. The containment step was performed before identification
  4. The root cause was not identified before eradication Correct answer.

Explanation

Eradication is durable only when the entry point, such as an unpatched service or stolen credential, is identified and corrected. Removing malware without addressing the root cause allows the attacker to reinfect the same way.

Question 36Incident Handling and Response Process

During a major incident, why should an organization use out-of-band communication channels?

  1. The compromised network may be untrustworthy Correct answer.
  2. They provide higher bandwidth than normal email
  3. They are required by forensic standards
  4. They automatically encrypt all messages

Explanation

If the corporate network or mail system is compromised, attacker-visible channels may be monitored, disrupted, or used to spread misinformation. Out-of-band channels such as separate conference bridges preserve confidentiality and availability of coordination.

Question 37Incident Handling and Response Process

Why should responders record actions and timestamps throughout an incident?

  1. To speed up the eradication of malware
  2. To prevent attackers from reading logs
  3. To support later analysis and legal defensibility Correct answer.
  4. To reduce the number of alerts generated

Explanation

Contemporaneous documentation builds the timeline used for analysis, supports evidence integrity, and demonstrates due diligence to regulators and courts. Recording actions does not influence alert volume or attacker visibility.

Question 38Incident Handling and Response Process

An investigation confirms that customer personal data was exfiltrated. Which additional process must the response team engage?

  1. Reimaging all endpoints in the environment
  2. Increasing the firewall log retention period
  3. Legal and regulatory breach notification Correct answer.
  4. Resetting passwords for all domain accounts

Explanation

Confirmed exfiltration of personal data triggers legal, contractual, and regulatory duties such as notifying regulators and affected individuals within defined timeframes. Technical containment does not discharge those obligations.

Question 39Incident Handling and Response Process

What is the main purpose of incident triage?

  1. To collect forensic images of all affected hosts
  2. To notify law enforcement of every incident
  3. To automate eradication of detected malware
  4. To prioritize incidents by impact and urgency Correct answer.

Explanation

Triage ranks incidents so that limited resources are directed to the most impactful and urgent events first. It is a prioritization step and does not itself acquire evidence, notify authorities, or remediate systems.

Question 40Incident Handling and Response Process

After corrective actions are implemented, which metric best shows that incident response capability has improved?

  1. The number of staff holding security certifications
  2. The total count of incidents in the ticketing system
  3. Mean time to detect and contain similar incidents Correct answer.
  4. The number of alerts generated per day

Explanation

Improved capability appears as faster, more consistent handling of comparable incidents, which is captured by detection and containment times. Volume and certification metrics measure activity or credentials rather than response performance.

Question 41First Response

Which activity best describes the primary objective of a first responder at a digital crime scene?

  1. Determine root cause and deliver the final incident report
  2. Preserve the scene and evidence and document all actions Correct answer.
  3. Identify and prosecute the attacker before any evidence is lost
  4. Restore affected systems to production as quickly as possible

Explanation

The first responder's job is to protect the scene, avoid altering digital evidence, and record what was observed and done. Root-cause analysis, full reporting, and remediation belong to later phases handled by the investigation and recovery teams.

Question 42First Response

Following the order of volatility, which item should be collected first from a running system?

  1. Archived email on the mail server
  2. Contents of the hard drive
  3. CPU cache and RAM contents Correct answer.
  4. Backup tapes stored offsite

Explanation

The order of volatility ranks evidence by how quickly it disappears: processor cache and RAM are lost within seconds of power loss, while disk contents survive shutdown. Offsite backups and archived mail are the least volatile and are collected last.

Question 43First Response

Which record documents who collected, handled, and transferred each item of evidence and when?

  1. Chain of custody form Correct answer.
  2. Vulnerability scan report
  3. Change management record
  4. Incident ticket log

Explanation

A chain of custody form records every custodian, transfer, date, and time for an evidence item so its integrity can be demonstrated later. Incident tickets, scan reports, and change records may describe the response but do not track evidence custody.

Question 44First Response

A first responder arrives at a workstation suspected of compromise. Which action should be taken before touching the keyboard or mouse?

  1. Photograph the screen and document its state Correct answer.
  2. Run an antivirus scan to confirm the infection
  3. Delete suspicious files from the desktop
  4. Reboot into safe mode to stop the malware

Explanation

The visible state of the screen may hold unrecoverable evidence such as open windows, messages, or running tools, so it is photographed and documented before any interaction. Interacting with the system alters state and can trigger attacker anti-forensic routines.

Question 45First Response

Why is a hardware write blocker used when imaging a suspect hard drive?

  1. It prevents writes from altering the source drive Correct answer.
  2. It decrypts the contents of the drive for analysis
  3. It repairs damaged sectors so the image is complete
  4. It speeds up the imaging process by compressing data

Explanation

A write blocker allows read commands to reach the drive while blocking any write command, so the source is not modified during acquisition. This keeps the original drive in its seized state and supports later integrity verification.

Question 46First Response

What is the main purpose of the containment phase of incident response?

  1. To limit the spread and impact while preserving evidence Correct answer.
  2. To update antivirus signatures across the enterprise
  3. To calculate the financial loss caused by the incident
  4. To permanently remove the attacker's access from the environment

Explanation

Containment stops an incident from spreading further while keeping the evidence needed for investigation intact. Removing attacker access permanently is eradication, and cost calculation and signature updates are separate activities.

Question 47First Response

A workstation is infected with malware that is actively beaconing to an external server. Which action is most appropriate for the first responder?

  1. Reimage the machine before any data is collected
  2. Run a full antivirus scan and quarantine detected files
  3. Power off the machine immediately at the wall socket
  4. Isolate it from the network and leave it powered on Correct answer.

Explanation

Disconnecting the host from the network stops command-and-control traffic and lateral spread while keeping memory and running processes available for capture. The host should stay powered on until volatile data is collected.

Question 48First Response

During an investigation, an evidence bag is found without a signature at a documented transfer point. What is the consequence?

  1. The evidence must be returned to the suspect's employer
  2. None, because the stored hash value proves integrity
  3. The evidence becomes admissible in civil but not criminal court
  4. The chain of custody is broken and integrity may be challenged Correct answer.

Explanation

A gap in the documented custody record means the item cannot be shown to have been under continuous control, so its integrity can be contested. A matching hash supports integrity but does not by itself repair an incomplete custody trail.

Question 49First Response

Which evidence is permanently lost if a running server is shut down before any capture is performed?

  1. Files stored on the server's data volume
  2. Running processes and open connections Correct answer.
  3. The master boot record of the system disk
  4. Windows event logs written to disk

Explanation

Process tables, network connections, loaded modules, and other memory-resident artefacts disappear when power is removed. Files, on-disk logs, and boot records persist and can be recovered from the disk afterwards.

Question 50First Response

After imaging a suspect drive, a responder compares the hash of the image with the hash of the source drive. What does a match demonstrate?

  1. The drive contained no deleted files
  2. The suspect's account was last to log on
  3. The image matches the source bit for bit Correct answer.
  4. The image has been encrypted with a strong algorithm

Explanation

Identical cryptographic hashes show that the acquired image and the source are byte-for-byte identical, so the copy can stand in for the original. Hashes say nothing about encryption, deleted content, or user activity.