100-160 Question 236
Select 3During an investigation of a security breach, a digital forensic analyst collects and examines a compromised system's logs, file metadata, and network traffic. Which of the following actions are critical to ensuring the integrity of the evidence and tracing the attack back to its source?
- A
Creating a cryptographic hash of the collected evidence to ensure it remains unaltered
- B
Immediately deleting suspicious files from the compromised system to prevent further damage
- C
Analyzing timestamps in file metadata to correlate attacker activity with system events
- D
Attributing the attack to an individual or group without verifying the evidence's accuracy
- E
Reviewing network traffic logs to identify potential command-and-control server communications
Show answer and explanation
Correct answers: A, C, E
Explanation
In digital forensics, maintaining evidence integrity, correlating attacker activity, and analyzing network traffic are critical steps for effective investigation and attack attribution. These actions ensure accurate conclusions and support the identification of the attacker while preserving the chain of custody.
- A. Correct.
Creating a cryptographic hash is essential to verify the integrity of the evidence, ensuring no changes occur during the investigation process.
- B. Incorrect.
Deleting suspicious files may hinder the investigation by destroying critical evidence required to analyze the attack.
- C. Correct.
Analyzing timestamps helps correlate the attacker's activity with specific events, providing valuable context for the investigation.
- D. Incorrect.
Attributing the attack without verifying evidence is a poor practice and can lead to incorrect conclusions during the investigation.
- E. Correct.
Reviewing network traffic logs can reveal connections to command-and-control servers, aiding in identifying the source and purpose of the attack.