300-215 Question 1
Select 3During an incident investigation, a cybersecurity analyst needs to use Cisco technologies to identify the root cause of a network compromise. Which of the following steps represents fundamental practices for effective forensic analysis and incident response?
- A
Isolate the affected systems to prevent further damage.
- B
Immediately delete suspicious files from the compromised systems.
- C
Collect and preserve logs from Cisco devices, such as Firepower and Secure Endpoint, for analysis.
- D
Use Cisco Umbrella to block malicious domain communications during the incident.
- E
Reboot all systems to clear potential malware from memory.
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective forensic analysis and incident response require isolating affected systems to limit the threat, collecting evidence such as logs for further analysis, and using tools like Cisco Umbrella to block communication with malicious domains. Deleting files or rebooting systems prematurely can result in lost evidence or incomplete investigations, which are contrary to the fundamentals of incident response.
- A. Correct.
Isolating the affected systems is a fundamental practice to prevent further propagation of the threat during an incident response.
- B. Incorrect.
Immediately deleting suspicious files is not recommended as it could destroy critical evidence required for forensic analysis.
- C. Correct.
Collecting and preserving logs from Cisco devices is a fundamental part of forensic analysis to understand the scope and nature of the compromise.
- D. Correct.
Blocking malicious domain communications using Cisco Umbrella is an effective containment strategy to disrupt the attacker's operations.
- E. Incorrect.
Rebooting systems during an active incident is not a best practice as it can erase volatile data in memory and hinder forensic investigation.