300-215 Question 14
Select 3During a forensic investigation of a network breach, you are tasked with analyzing a compromised Cisco router. Which of the following steps are critical in performing a forensic analysis of the device while maintaining evidence integrity?
- A
Capture the running and startup configurations of the router using Cisco CLI commands.
- B
Reboot the router to clear any malicious processes before analysis.
- C
Collect and export the router's syslog data from the centralized logging server.
- D
Take a snapshot of the router's memory (RAM) for volatile data analysis.
- E
Update the router's firmware to patch any potential vulnerabilities before conducting forensic analysis.
Show answer and explanation
Correct answers: A, C, D
Explanation
Forensic analysis of a network device like a Cisco router requires careful steps to preserve evidence integrity while gathering as much information as possible. Capturing configurations, syslog data, and memory snapshots are all critical actions for reconstructing the attack and identifying potential vulnerabilities. Conversely, actions like rebooting the device or updating its firmware can destroy or alter evidence, compromising the investigation's validity.
- A. Correct.
Capturing the running and startup configurations is essential to identify unauthorized changes, such as altered ACLs, routes, or user accounts, which might have been made by attackers.
- B. Incorrect.
Rebooting the router destroys volatile data in memory, such as active sessions, processes, and cached logs, which are vital for forensic analysis. This step would compromise evidence integrity.
- C. Correct.
Syslog data often contains critical information about events leading up to and during an incident. Exporting this data helps in reconstructing the timeline of the attack.
- D. Correct.
A memory snapshot is crucial for analyzing volatile data, such as running processes, active connections, and cached credentials, which can provide insight into the attacker's activities.
- E. Incorrect.
Updating firmware introduces changes to the system that could overwrite evidence or alter the state of the compromised device, making it unsuitable for forensic analysis.