300-215 Question 11
Select 3You are tasked with performing a forensic analysis of a compromised network device within your organization's infrastructure. Which of the following steps should you prioritize to ensure the integrity and reliability of the forensic process?
- A
Capture a forensic image of the device's memory and storage before making any configuration changes.
- B
Immediately reboot the device to terminate any malicious processes and restore functionality.
- C
Export the device's configuration and log files for analysis.
- D
Verify the device's clock settings and time synchronization to ensure accurate log timestamps.
- E
Use Cisco Stealthwatch to monitor current network traffic for unusual behavior originating from the device.
Show answer and explanation
Correct answers: A, C, D
Explanation
The forensic process for analyzing compromised network devices involves preserving evidence, such as memory and storage, collecting vital configuration and log data, and ensuring timestamp accuracy for reliable analysis. Steps that compromise evidence integrity, such as rebooting, should be avoided. Tools like Cisco Stealthwatch are useful for broader incident response but are not specific to the forensic imaging or analysis of the device itself.
- A. Correct.
Capturing a forensic image of the device's memory and storage is critical to preserving evidence in its original state. This ensures that no data is lost or altered before analysis begins.
- B. Incorrect.
Rebooting the device can destroy volatile memory and disrupt the evidence, making it unsuitable for forensic analysis. This is not a recommended step during the initial forensic process.
- C. Correct.
Exporting the device's configuration and log files is essential for understanding the state of the device and identifying any malicious activity or unauthorized changes.
- D. Correct.
Verifying the clock settings and time synchronization ensures that log files and timestamps are accurate, which is critical for reconstructing events in a forensic timeline.
- E. Incorrect.
While monitoring network traffic for unusual behavior is useful for incident response, it is not a priority during the initial forensic analysis of the compromised device itself.