200-201 Question 361
Select 2An organization has detected unauthorized access to a critical file server. The cybersecurity team has been tasked with preserving data for a potential forensic investigation. Which of the following actions should the team take to ensure proper data preservation?
- A
Document the current state of the system, including running processes and network connections.
- B
Immediately disconnect the file server from the network to prevent further unauthorized access.
- C
Modify the file permissions on the server to restrict access and prevent changes to files.
- D
Make a bit-by-bit forensic image of the server's storage devices before powering it down.
- E
Delete temporary files to clear unused space for imaging.
Show answer and explanation
Correct answers: A, D
Explanation
Data preservation in cybersecurity is critical to maintain the integrity and completeness of evidence for forensic investigations. Documenting the system's current state captures important volatile data, while creating a forensic image ensures a complete and unaltered copy of the storage devices. Actions that modify or delete data, such as changing permissions or clearing temporary files, should be avoided to ensure evidence remains intact.
- A. Correct.
Documenting the current state of the system is critical for forensic investigations as it captures volatile data such as running processes and active network connections that could be lost if the system is powered down.
- B. Incorrect.
Disconnecting the server from the network might prevent further unauthorized access, but it could also disrupt the investigation by altering volatile data. Proper preservation requires considering the impact on the evidence.
- C. Incorrect.
Modifying file permissions could alter the evidence and is not considered a proper data preservation technique in a forensic context.
- D. Correct.
Creating a bit-by-bit forensic image ensures that the exact data from the storage devices is preserved without alteration, which is a key requirement for forensic investigations.
- E. Incorrect.
Deleting temporary files would destroy potentially valuable evidence and is contrary to proper data preservation practices.