100-160 Question 242
Select 3A cybersecurity analyst is investigating a potential data breach at an organization. They are tasked with using the Cyber Kill Chain and MITRE ATT&CK Matrix to identify the attack's progression and gather digital evidence. During the investigation, they recover a suspicious executable file from a compromised system. Which of the following actions should the analyst take to ensure proper evidence handling and analysis?
- A
Create a cryptographic hash of the file before conducting any analysis.
- B
Analyze the file directly on the compromised system to preserve its context.
- C
Document all actions taken during the investigation, including timestamps.
- D
Allow other team members to handle the file without documenting the chain of custody.
- E
Store a copy of the file in a secure, write-protected location.
Show answer and explanation
Correct answers: A, C, E
Explanation
Proper evidence handling is critical in cybersecurity investigations to ensure the integrity and admissibility of digital evidence. Key steps include creating cryptographic hashes to verify evidence integrity, documenting all actions taken (including timestamps), and securely storing evidence in a write-protected location. Avoid actions that could alter evidence, such as analyzing it directly on the compromised system, and always maintain a documented chain of custody to prevent evidence tampering or questions about its authenticity.
- A. Correct.
Creating a cryptographic hash of the file ensures its integrity can be verified, which is a critical step in preserving digital evidence.
- B. Incorrect.
Analyzing the file directly on the compromised system can alter the evidence and is not a recommended practice for proper evidence handling.
- C. Correct.
Documenting all actions, including timestamps, is essential for maintaining the integrity of the investigation and ensuring the evidence is admissible in legal proceedings.
- D. Incorrect.
Allowing multiple team members to handle the file without documenting the chain of custody risks compromising the integrity of the evidence, making it less reliable.
- E. Correct.
Storing a copy of the file in a secure, write-protected location ensures the evidence is not modified and remains preserved for further analysis.