712-50 Question 358
Single answerIncident Response and Computer Forensics (6 questions)A global manufacturing company discovers that a senior engineer's workstation was used to access a restricted design repository and exfiltrate several gigabytes of proprietary files late at night. The incident response team wants to determine whether the activity was performed by the engineer, by malware using the engineer's credentials, or by an external actor with remote access. Law enforcement may become involved, and outside counsel has instructed the CISO to ensure evidence will be admissible if litigation follows. Which action should the CISO prioritize FIRST to best support both effective investigation and legal defensibility?
- A
Immediately reimage the workstation after collecting screenshots of active sessions so business operations can resume quickly
- B
Direct the team to perform a forensically sound acquisition of volatile and non-volatile evidence, document chain of custody, and preserve original media before deeper analysis begins
- C
Have the SOC block the engineer's account and delete any suspected malware artifacts to prevent further data loss before collecting evidence
- D
Ask internal audit to interview the engineer and system administrators first, then decide whether technical evidence collection is necessary
Show answer and explanation
Correct answer: B
Explanation
In an incident with possible data exfiltration, insider involvement, credential misuse, or malware, the CISO's first priority should be evidence preservation using sound forensic procedures. A defensible investigation typically includes identifying and collecting volatile data when justified, imaging storage media using validated tools, calculating and recording cryptographic hashes, preserving originals, using working copies for analysis, and maintaining a documented chain of custody. These practices are consistent with common digital forensics principles and incident handling guidance, including NIST SP 800-61 (Computer Security Incident Handling Guide) and NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response). The key leadership decision is sequencing: preserve and document first, then analyze, contain, eradicate, and recover in a way that balances business continuity with evidentiary integrity.
- A. Incorrect.
This is incorrect because screenshots and rapid reimaging do not preserve the full evidentiary record. Reimaging destroys potentially critical artifacts such as memory contents, system logs, malware persistence mechanisms, timestamps, browser/session data, and deleted files. While business restoration matters, the scenario emphasizes possible legal action and the need to distinguish among insider misuse, credential compromise, and malware. That requires disciplined forensic preservation before altering the system.
- B. Correct.
This is correct because the highest-priority action is to preserve evidence in a forensically sound manner before it is changed or lost. That includes collecting volatile data where appropriate, acquiring disk images using validated methods, maintaining integrity through hashing, documenting who handled the evidence and when, and preserving originals for possible court review. This approach aligns with established incident response and digital forensics practice, supports root-cause analysis, and protects admissibility and credibility of findings.
- C. Incorrect.
This is incorrect because deleting artifacts before collection can irreparably damage the investigation and undermine legal defensibility. Account restriction may be appropriate as a containment step, but the option couples containment with evidence destruction. In cases involving potential insider threat, malware, or remote compromise, preserving the state of the system is essential. Premature cleanup is a common operational mistake when teams focus only on eradication rather than coordinated response and forensics.
- D. Incorrect.
This is incorrect because witness interviews can be useful, but they should not take precedence over preserving technical evidence that may be transient. Memory contents, active network connections, process data, and volatile logs can disappear quickly. Interviews also introduce bias and do not establish what actually occurred on the endpoint. In a potentially litigated matter, contemporaneous technical evidence collection is more urgent than relying first on recollection or statements.