300-215 Question 15
Select 3During a forensic investigation, you are tasked with analyzing a compromised Cisco router in your network. Which of the following steps are essential to performing forensic analysis on this infrastructure network device?
- A
Capture and analyze the router's volatile memory using network device-specific tools.
- B
Take a snapshot of the network device's running configuration and compare it to the startup configuration.
- C
Perform a factory reset on the router to ensure it is returned to a clean state before analysis.
- D
Collect logs from the router, such as syslog and NetFlow data, for timeline reconstruction.
- E
Update the router's firmware to the latest version before performing forensic analysis.
Show answer and explanation
Correct answers: A, B, D
Explanation
Forensic analysis of infrastructure network devices involves capturing volatile memory, examining configurations for unauthorized changes, and collecting logs for event reconstruction. Steps that alter the system state, such as factory resets or firmware updates, should be avoided as they can destroy critical evidence necessary for the investigation.
- A. Correct.
Capturing volatile memory is critical because it contains information that may be lost upon device reboot, such as active processes, ARP tables, and routing tables.
- B. Correct.
Comparing the running configuration to the startup configuration helps identify unauthorized changes to the device's settings that may have been made by an attacker.
- C. Incorrect.
Performing a factory reset is not appropriate during forensic analysis, as it would erase evidence critical to the investigation.
- D. Correct.
Collecting logs, such as syslog and NetFlow data, is essential for timeline reconstruction and determining the sequence of events leading to the compromise.
- E. Incorrect.
Updating the firmware would modify the system state, potentially destroying forensic evidence. Firmware updates should be avoided during an active investigation.