100-160 Question 240
Select 3During an investigation of a suspected ransomware attack, a cybersecurity analyst uses the MITRE ATT&CK Matrix to identify the attack's Tactics, Techniques, and Procedures (TTP). The analyst finds evidence of lateral movement in the organization’s network. Which of the following steps should the analyst take to properly handle the evidence and maintain its integrity?
- A
Document the evidence chain of custody, including who handled it and when.
- B
Immediately analyze the evidence on the affected system to gather real-time insights.
- C
Create a forensic image of the affected system's disk before conducting any analysis.
- D
Store the original evidence in a secure location to prevent unauthorized access.
- E
Delete irrelevant files from the evidence to save storage space.
Show answer and explanation
Correct answers: A, C, D
Explanation
Proper evidence handling in cybersecurity incidents involves preserving the integrity of the original data, maintaining a documented chain of custody, and ensuring the evidence is securely stored. These practices are essential for maintaining the credibility of the evidence and supporting the investigation while preventing accidental or intentional tampering.
- A. Correct.
This is correct because maintaining a documented chain of custody is essential for ensuring the evidence is admissible in court and proving it has not been tampered with.
- B. Incorrect.
This is incorrect because immediately analyzing evidence on the affected system could alter or corrupt the original data, violating evidence handling best practices.
- C. Correct.
This is correct because creating a forensic image ensures that the original evidence remains unchanged, allowing analysis to be performed on the copy without compromising the integrity of the original data.
- D. Correct.
This is correct because storing the original evidence in a secure location prevents unauthorized access and ensures the data is preserved in its original state.
- E. Incorrect.
This is incorrect because deleting files from the evidence can compromise the investigation and violate evidence handling procedures, as even seemingly irrelevant files may contain critical information.