712-50 Question 359
Single answerIncident Response and Computer Forensics (6 questions)A multinational company discovers that a senior engineer may have exfiltrated proprietary source code to a personal cloud account before resigning. The legal department states that civil litigation is likely, and regulators may later request evidence of how the investigation was handled. The CISO is asked to direct the initial response so that the organization can both contain risk and preserve evidence for potential legal proceedings. Which action should the CISO prioritize FIRST?
- A
Immediately have IT remotely wipe the engineer's laptop and mobile phone to prevent any further data leakage
- B
Direct the incident response team to collect and preserve volatile and non-volatile evidence using documented forensic procedures and chain of custody before making major changes to the suspect systems
- C
Ask HR to interview the engineer immediately and request a written statement before involving legal counsel or forensic specialists
- D
Suspend all access to the source code repository for the entire engineering department until the investigation is completed
Show answer and explanation
Correct answer: B
Explanation
In an incident with potential insider theft, likely civil litigation, and possible regulatory scrutiny, the CISO should first ensure evidence is preserved in a defensible manner. Best practice in incident response and digital forensics is to identify, collect, preserve, and document evidence before making unnecessary changes to systems. This includes using approved forensic procedures, preserving relevant logs, considering volatile data capture where justified, and maintaining a clear chain of custody. These steps align with established guidance such as NIST SP 800-61 Computer Security Incident Handling Guide, which emphasizes evidence preservation and coordination, and NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response, which addresses forensic collection and handling. From a leadership perspective, the CISO must balance containment, legal risk, and business continuity; however, where legal action is probable, preserving evidence before destructive or intrusive actions is the most appropriate first priority.
- A. Incorrect.
This is incorrect because wiping devices destroys potentially critical evidence and could seriously undermine internal investigation, litigation, or regulatory review. While containment is important, evidence preservation must be handled carefully when legal action is anticipated. A remote wipe may also eliminate volatile artifacts, logs, browser data, cloud sync traces, and other forensic evidence needed to establish what occurred.
- B. Correct.
This is correct because when litigation or regulatory scrutiny is likely, the organization should preserve evidence in a forensically sound manner as early as possible. That includes collecting volatile data where appropriate, imaging relevant systems, preserving logs, documenting every action taken, and maintaining chain of custody. This supports both incident response and legal defensibility. Major system changes before preservation can alter or destroy evidence and weaken the organization's position.
- C. Incorrect.
This is incorrect because interviewing the suspect too early can alert them, create opportunities for evidence tampering elsewhere, and complicate coordination with legal counsel. HR involvement may be necessary, but from an incident response and forensics perspective, evidence preservation and legal coordination should occur first when legal proceedings are likely.
- D. Incorrect.
This is incorrect because broad access suspension across the entire engineering department is an overreaching containment measure that may cause unnecessary business disruption without first preserving relevant evidence. It also does not directly address the immediate need for legally defensible evidence handling. Targeted containment may be appropriate later, but the first priority in this scenario is forensic preservation.