CISSP Incident Response and Forensics 2 — Questions and Answers
Question 1: During a forensic investigation, an investigator calculates an MD5 hash of a disk image immediately after acquisition. What is this process called?
- Evidence tagging
- Hash validation / integrity verification (Correct answer)
- Digital signing
- Chain of custody logging
Correct answer: Hash validation / integrity verification
Hashing the evidence immediately after acquisition and then verifying the hash before analysis is called integrity verification, confirming the image has not been altered.
Question 2: Which concept describes the systematic process of identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner?
- Threat intelligence
- Digital forensics (Correct answer)
- Vulnerability assessment
- Risk analysis
Correct answer: Digital forensics
Digital forensics is the scientific discipline of identifying, preserving, analyzing, and presenting digital evidence in ways that are legally defensible.
Question 3: An organization's IR plan calls for isolating an infected workstation by disabling its network interface. Which containment strategy does this represent?
- Long-term containment
- Short-term containment (Correct answer)
- Eradication
- Recovery
Correct answer: Short-term containment
Short-term containment involves immediate actions like disabling a network interface to stop the spread of an incident while longer-term solutions are prepared.
Question 4: What is 'locard's exchange principle' and how does it apply to digital forensics?
- Every criminal leaves a digital signature that is unique
- Every contact leaves a trace — digital actions leave artifacts behind (Correct answer)
- Digital evidence must be encrypted before transfer
- A forensic examiner must never access original evidence directly
Correct answer: Every contact leaves a trace — digital actions leave artifacts behind
Locard's Exchange Principle states that every contact leaves a trace; in digital forensics, this means that whenever someone interacts with a system, artifacts such as logs and registry entries are left behind.
Question 5: Which of the following is a primary benefit of having a Computer Security Incident Response Team (CSIRT)?
- Eliminating all security vulnerabilities
- Providing a structured, coordinated response to security incidents (Correct answer)
- Replacing the need for security monitoring tools
- Preventing all malware infections
Correct answer: Providing a structured, coordinated response to security incidents
A CSIRT provides an organized, expert team that can respond quickly and effectively to incidents, minimizing damage and recovery time through coordinated effort.
Question 6: In the context of incident response, what does the term 'dwell time' refer to?
- The time required to restore systems after eradication
- The length of time an attacker remains undetected in a network (Correct answer)
- The duration of the containment phase
- The time between incident discovery and law enforcement notification
Correct answer: The length of time an attacker remains undetected in a network
Dwell time (also called mean time to detect) is the period an attacker is present and active in a network before being discovered, which attackers try to maximize.
Question 7: Which type of malware analysis involves executing a suspicious file in a controlled environment to observe its behavior?
- Static analysis
- Code review
- Dynamic analysis (Correct answer)
- Signature-based analysis
Correct answer: Dynamic analysis
Dynamic analysis (behavioral analysis) involves running the malware in a controlled sandbox environment to observe its actual behavior, network connections, and system changes.
CISSP Incident Response and Forensics 2
During a forensic investigation, an investigator calculates an MD5 hash of a disk image immediately after acquisition.
What is this process called?