CySA+ Days 7 & 8

A record of a problem reported by a user or detected by a system is known as a (blank).

• Requirement

• Incident

• Trouble Ticket

• IT issue

This term refers to a security event that compromises the Confidentiality, Integrity, or Availability of an information system.

• Trouble Ticket

• Breach

• Incident

• Change Request

What is a forensic image?

• A forensic image is a type of digital camera used in investigations.
• A forensic image is a physical photograph taken at a crime scene.
• A forensic image is a complete, exact copy of a digital storage device used for forensic analysis.
• A forensic image is a software program for data recovery.

What must you do prior to collecting forensic evidence during an incident response?

• Establish a Chain of Custody

• Obtain Authorization or Consent

• Create a bit-by-bit copy of the storage device

• Obtain a tamper-evident bag & seal

What can a forensic investigator perform periodically to safeguard the collected data against any accidental or intentional alterations during the investigation process?

• Seal it in a tamper-evident bag

• Store it in a secure location

• Maintain a proper Chain of Custody

• Conduct a Data Integrity Check

Which technique can be used to provide a way to verify the authenticity and integrity of data during forensic investigations?

• Use tamper tape

• Store it in a secure location

• Digitally sign a copy of it

• Sprinkle salt on some hash browns

What is the best way a forensic investigator can validate the integrity of a physical device during an incident response?

• Use tamper-evident seals

• Store it in a secure foot locker

• Keep it in a personal safe

• Keep it under 24/7 surveillance

Which Preservation technique involves making a bit-for-bit copy of an entire storage device?

• Snapshot

• Backup

• Disk Image

• Hash the disk

Which term describes assessing an incident to understand its severity and impact on the organization?

• incident evaluation
• incident reporting
• incident analysis

• triage

True or False? Removing the root cause of an incident happens in the Containment phase of Incident Response.

• True!

• False!

Answer explanation

Removing or addressing the Root Cause happens in the Eradication and Recovery phase.