300-215 Question 174
Select 3During a forensic investigation, you are tasked with analyzing a suspicious file that was downloaded onto a corporate endpoint. You use Cisco Secure Endpoint to identify the threat and gather contextual data. Which processes should you follow to ensure proper forensic analysis and evidentiary integrity?
- A
Preserve the file in its original state and create a hash for verification.
- B
Immediately delete the file to prevent further risk to the network.
- C
Document all actions taken during the analysis to maintain a clear chain of custody.
- D
Analyze the file in a secure, isolated environment such as a sandbox or virtual machine.
- E
Modify the file to test its behavior in different environments.
Show answer and explanation
Correct answers: A, C, D
Explanation
Forensic processes require maintaining the integrity of evidence, documenting actions for chain of custody, and analyzing the threat in a controlled environment to ensure accurate and admissible findings. Actions such as deleting or modifying the file violate forensic best practices, which could compromise the investigation and evidence.
- A. Correct.
Preserving the file in its original state and creating a hash ensures evidentiary integrity, which is critical for forensic investigations.
- B. Incorrect.
Deleting the file may prevent further risk, but it destroys critical evidence needed for forensic analysis and incident response.
- C. Correct.
Documenting all actions is essential to maintaining a clear chain of custody, which ensures that evidence is admissible and credible.
- D. Correct.
Analyzing the file in a secure, isolated environment ensures that the investigation does not affect the live system and minimizes the risk of spreading malicious activity.
- E. Incorrect.
Modifying the file compromises its original state, which invalidates its use as evidence in a forensic investigation.