300-215 Question 4
Single answerAn organization suspects that unauthorized access to sensitive data has occurred. As a cybersecurity analyst, you are tasked with initiating the forensic analysis process using Cisco technologies. Which of the following steps should be performed first to ensure the integrity of the investigation?
- A
Isolate the affected systems from the network to prevent further damage.
- B
Capture and preserve volatile data, such as running processes and memory contents.
- C
Analyze logs from Cisco Secure Firewall to identify suspicious activity.
- D
Generate a detailed report of the incident for management review.
Show answer and explanation
Correct answer: B
Explanation
The first priority in forensic analysis is to preserve evidence, especially volatile data such as running processes, memory contents, and active network connections, as this data can be lost quickly. Cisco technologies, such as Cisco Secure Endpoint or Cisco Secure Network Analytics, can assist with data collection and analysis, but the initial focus should always be on preserving volatile information.
- A. Incorrect.
While isolating affected systems is important, it should not be the first step because volatile data could be lost during isolation.
- B. Correct.
Capturing and preserving volatile data is the correct first step, as this data can be lost if the system is shut down or altered.
- C. Incorrect.
Analyzing logs is crucial but should be performed after volatile data is captured, as logs are not as time-sensitive as system memory or running processes.
- D. Incorrect.
Generating a report is a later step in the incident response process and is not relevant to the immediate need for data preservation.