200-201 Question 362
Select 3A cybersecurity analyst is investigating a potential data breach at an organization. The analyst needs to preserve evidence for further analysis and potential legal proceedings. Which actions should the analyst prioritize to ensure proper data preservation?
- A
Create a forensic image of the affected systems using a write-blocker.
- B
Immediately shut down the affected systems to prevent further data loss.
- C
Document details such as timestamps, system configurations, and network logs.
- D
Store the preserved data on a shared network drive accessible by all team members.
- E
Verify the integrity of the preserved data using cryptographic hash values.
Show answer and explanation
Correct answers: A, C, E
Explanation
Proper data preservation involves creating a forensic image to capture evidence without altering the original data, documenting all relevant details to support the investigation, and verifying the integrity of the preserved data to ensure its admissibility in legal or regulatory contexts. Actions that risk data loss, alteration, or unauthorized access, such as shutting down systems or using shared drives, should be avoided.
- A. Correct.
Creating a forensic image ensures that a bit-for-bit copy of the affected system is preserved without altering the original data. Using a write-blocker prevents accidental modifications.
- B. Incorrect.
Shutting down the affected system can lead to the loss of volatile data, such as information stored in memory, and is not recommended unless absolutely necessary.
- C. Correct.
Documenting system details, including timestamps and logs, is a critical part of the data preservation process to maintain the chain of custody and context for the investigation.
- D. Incorrect.
Storing preserved data on a shared network drive can lead to unauthorized access or accidental modification, which compromises the integrity of the evidence.
- E. Correct.
Verifying the integrity of preserved data using cryptographic hash values ensures that the evidence remains unaltered and can be trusted during analysis or legal proceedings.