300-215 Question 172
Select 2During an incident investigation, a cybersecurity analyst is tasked with collecting volatile data from a compromised server using Cisco tools. Which of the following steps are critical to ensure proper forensic processes are followed during this collection?
- A
Document the collection process, including timestamps and tools used.
- B
Shut down the compromised server immediately to preserve the state of the system.
- C
Use Cisco Cyber Vision to extract and analyze memory data.
- D
Ensure a chain-of-custody form is completed and signed for the collected data.
- E
Perform live analysis on the server without recording your actions for efficiency.
Show answer and explanation
Correct answers: A, D
Explanation
Proper forensic processes require careful documentation of the collection process and maintaining the integrity and accountability of evidence through a chain-of-custody form. Shutting down a server prematurely or failing to record actions can compromise the investigation. Using the appropriate tools and processes ensures that volatile data is preserved and the evidence is admissible in legal or compliance-related scenarios.
- A. Correct.
Documenting the collection process is a critical step in forensic processes to maintain the integrity of evidence and provide a clear record for auditing and legal purposes.
- B. Incorrect.
Shutting down the server immediately can result in the loss of volatile data, such as memory contents and running processes, which are critical for forensic analysis.
- C. Incorrect.
Cisco Cyber Vision is primarily used for visibility and monitoring in OT/IoT environments. It is not specifically designed for volatile data extraction from servers.
- D. Correct.
Completing a chain-of-custody form ensures the integrity and accountability of the evidence during its handling, which is a vital part of forensic processes.
- E. Incorrect.
Performing live analysis without recording actions violates forensic best practices, as it can lead to a lack of accountability and unreliable evidence.