100-160 Question 238
Select 3During a cybersecurity investigation, an analyst is tasked with identifying the source of a ransomware attack within a corporate network. Which of the following steps should the analyst take to perform digital forensics and attack attribution effectively?
- A
Preserve evidence by creating a bit-for-bit copy of the affected systems' storage.
- B
Modify critical system files to prevent further infection during the investigation.
- C
Analyze system logs, such as firewall and server logs, for indicators of compromise (IOCs).
- D
Identify and isolate the compromised systems to prevent lateral movement by the attacker.
- E
Immediately delete all suspicious files to ensure the system is safe for continued use.
Show answer and explanation
Correct answers: A, C, D
Explanation
To effectively conduct digital forensics and attack attribution, the analyst must preserve evidence, analyze logs for indicators of compromise, and isolate affected systems to contain the threat. These steps form the core of a methodical and professional forensic process. Modifying files or deleting evidence is counterproductive and can compromise the investigation.
- A. Correct.
Preserving evidence by creating a bit-for-bit copy is a fundamental step in digital forensics to ensure the integrity of the data and allow accurate analysis without altering the original evidence.
- B. Incorrect.
Modifying critical system files can compromise evidence and is considered poor practice in forensic investigations. It may also interfere with proper analysis and attribution.
- C. Correct.
Analyzing system logs is essential for identifying indicators of compromise (IOCs) and understanding the attack's origin and method of execution.
- D. Correct.
Isolating compromised systems prevents the attacker from moving further within the network and ensures containment of the attack during forensic analysis.
- E. Incorrect.
Deleting suspicious files without proper analysis destroys critical evidence and hinders the ability to attribute the attack or understand its full impact.