300-215 Question 173
Select 3During an incident investigation, a cybersecurity analyst is tasked with preserving evidence from a compromised endpoint. Which of the following steps should the analyst prioritize to ensure proper forensic processes are followed?
- A
Capture a memory dump from the endpoint before shutting it down.
- B
Disconnect the endpoint from the network to prevent further malicious activity.
- C
Immediately delete malicious files to stop the attacker from accessing them.
- D
Document all actions taken during the investigation, including timestamps.
- E
Analyze the endpoint logs in real-time before securing the evidence.
Show answer and explanation
Correct answers: A, B, D
Explanation
Proper forensic processes prioritize the preservation of evidence, containment of the threat, and maintaining a clear chain of custody. Capturing volatile data (e.g., memory dumps), isolating compromised systems, and documenting actions are critical steps to ensure the integrity of the investigation. Actions such as deleting files or performing real-time analysis without securing evidence can compromise the investigation and lead to loss of critical information.
- A. Correct.
Capturing a memory dump is a critical step in preserving volatile data, such as processes and network connections, which can disappear upon shutdown. This is an essential part of proper forensic processes.
- B. Correct.
Disconnecting the endpoint from the network prevents the attacker from continuing their activities and reduces the risk of further damage. This is a standard step in incident response.
- C. Incorrect.
Deleting malicious files can result in the destruction of evidence, which is against forensic best practices. Proper evidence handling requires preserving all data for analysis.
- D. Correct.
Documenting all actions taken ensures a reliable chain of custody and maintains the integrity of the forensic investigation, which is essential for legal and procedural purposes.
- E. Incorrect.
Analyzing logs in real-time without first securing the evidence can lead to contamination or loss of data, violating forensic best practices.