300-215 Question 178
Select 3A cybersecurity analyst is conducting an investigation on a potential data breach using Cisco Secure Endpoint and discovers that the threat actor has employed multiple antiforensic techniques to hinder detection. Which of the following techniques is MOST likely to have been used to prevent forensic analysis?
- A
Altering file metadata to mislead investigators
- B
Encrypting sensitive data before exfiltrating it
- C
Using a VPN to mask the attacker's geolocation
- D
Deleting system logs to erase traces of activity
- E
Performing regular backups of compromised systems
Show answer and explanation
Correct answers: A, C, D
Explanation
Antiforensic techniques aim to hinder forensic analysis and detection efforts. Altering file metadata (obfuscation), using a VPN (geolocation evasion), and deleting system logs (data destruction) are typical examples of such techniques. These actions are often employed by attackers to mislead investigators and make it harder to trace or attribute malicious activity.
- A. Correct.
Altering file metadata is a common obfuscation technique used to mislead forensic investigators by modifying timestamps or ownership information.
- B. Incorrect.
Encrypting data before exfiltration is a data protection measure, not an antiforensic technique aimed at hindering forensic analysis.
- C. Correct.
Using a VPN to mask the attacker's geolocation is a common antiforensic technique to evade detection and attribution.
- D. Correct.
Deleting system logs is a data destruction technique intended to erase evidence and hinder forensic investigation.
- E. Incorrect.
Performing regular backups is a legitimate security practice and is not relevant to antiforensic activities.