100-160 Question 241
Single answerAn organization’s security team has detected unusual network activity indicating a possible intrusion. They decide to use the Cyber Kill Chain framework to track the attack. During the 'Delivery' stage, they identify a malicious email attachment. What is the most appropriate next step to ensure proper evidence handling and analysis?
- A
Isolate the email and attachment, document its metadata, and preserve it in a secure evidence repository.
- B
Delete the email from the system to prevent further spread of the malware.
- C
Open the attachment in a sandbox environment to confirm the malware behavior without documenting the findings.
- D
Quarantine the affected host and immediately share the email publicly to warn others.
Show answer and explanation
Correct answer: A
Explanation
In cybersecurity investigations, maintaining the chain of custody and preserving digital evidence are critical. According to the Cyber Kill Chain framework, identifying and isolating artifacts during the 'Delivery' stage enables analysts to better understand the attack and respond effectively. By securely storing the evidence and documenting its metadata, the organization ensures compliance with legal and procedural standards.
- A. Correct.
Proper evidence handling involves isolating and preserving the artifact (the email and attachment), documenting its metadata, and storing it securely. This ensures the chain of custody is maintained for further analysis or legal proceedings.
- B. Incorrect.
Deleting the email prevents further spread but destroys crucial evidence, making it unsuitable for investigation or prosecution.
- C. Incorrect.
Opening the attachment in a sandbox may help understand the malware's behavior, but failing to document the findings or preserve the evidence violates proper evidence handling procedures.
- D. Incorrect.
Quarantining the host is a good step, but sharing the email publicly without proper authorization or handling can lead to data breaches or legal issues.