300-215 Question 13
Select 4A security analyst is investigating a potential compromise on a network device. During the forensic analysis process, which of the following steps should the analyst take to ensure accurate data collection and analysis from the infrastructure network device?
- A
Collect the device's running configuration and startup configuration.
- B
Capture and analyze live network traffic originating from the device.
- C
Reboot the device to clear any malicious processes before investigation.
- D
Export and review the device's logs, such as syslog or SNMP traps.
- E
Perform a firmware update to ensure the device is running the latest version.
- F
Take a snapshot of the device's memory (if supported) for deeper analysis.
Show answer and explanation
Correct answers: A, B, D, F
Explanation
Effective forensic analysis of network infrastructure devices involves collecting both static and volatile data. This includes gathering configuration files, capturing live traffic, analyzing logs, and, if possible, taking memory snapshots. These steps ensure a comprehensive investigation while preserving evidence integrity. Actions like rebooting or firmware updates can overwrite or destroy critical forensic evidence and should be avoided during the investigation.
- A. Correct.
Collecting the running and startup configurations is critical as they provide insights into the current and saved operational state of the device, including any possibly malicious changes.
- B. Correct.
Capturing and analyzing live network traffic helps identify abnormal communications or ongoing malicious activity originating from or targeting the device.
- C. Incorrect.
Rebooting the device is not recommended as it may destroy volatile evidence such as memory data and disrupt ongoing forensic analysis.
- D. Correct.
Device logs, such as syslogs or SNMP traps, are essential for understanding historical events and identifying patterns or activities leading to the compromise.
- E. Incorrect.
Performing a firmware update during an investigation can overwrite critical forensic evidence and is not a recommended step during the analysis phase.
- F. Correct.
Taking a snapshot of the device's memory (if supported) provides valuable volatile data, such as running processes or active connections, which can be crucial for identifying malicious behavior.