712-50 Question 388
Single answerDesign anti-forensic techniquesA global financial services firm is redesigning its cyber resilience program after discovering that a ransomware affiliate delayed detection by deleting Windows event logs, using timestomping on dropped tools, and abusing legitimate administrative utilities to avoid malware signatures. The CISO asks for a defensive initiative specifically focused on countering anti-forensic techniques while preserving legal defensibility and operational feasibility across on-premises servers and cloud workloads. Which action should the CISO prioritize first?
- A
Implement centralized, append-only log collection with protected time synchronization and restrict local log-clearing privileges across endpoints, servers, and cloud control planes
- B
Deploy full-disk encryption on all endpoints so attackers cannot alter artifacts without the decryption key
- C
Increase the retention period of local endpoint logs from 7 days to 90 days and allow administrators to manage them during incidents
- D
Rely primarily on endpoint antivirus signatures tuned to detect timestomping and common log deletion tools
Show answer and explanation
Correct answer: A
Explanation
The best first priority is to ensure that critical forensic evidence cannot be easily altered or destroyed on the compromised host. Anti-forensic techniques commonly include log deletion, timestomping, fileless execution, process injection, and use of legitimate administrative tools. From a CCISO perspective, the most effective executive decision is to reduce dependence on host-resident evidence by implementing centralized, tamper-resistant logging with synchronized time sources and strong access controls. This supports both operational detection and post-incident investigation.
Industry guidance consistently supports this direction. NIST guidance on logging and event management emphasizes centralized collection, protection of log integrity, and accurate time synchronization as foundational for incident handling and forensic reconstruction. NIST incident response and forensic guidance also stresses preserving evidence in a manner that supports chain of custody and minimizes opportunities for attacker tampering. In cloud environments, the same principle applies through centralized audit trails and immutable or write-once retention features where available. As a strategic control, this is more effective than relying mainly on endpoint signatures or keeping logs only on local systems, both of which are vulnerable to anti-forensic actions by a capable adversary.
- A. Correct.
Correct. Centralized, append-only or otherwise tamper-resistant logging directly addresses common anti-forensic tactics such as local log clearing and timestamp manipulation by preserving evidence off-host before an attacker can alter or delete it. Protected time synchronization is also critical because anti-forensic activity often includes timestomping or clock manipulation to obscure timelines. Restricting local privileges needed to clear logs reduces the chance that attackers or over-privileged insiders can remove evidence. This approach is practical and legally defensible because it improves chain of custody, supports incident reconstruction, and aligns with established security logging practices in enterprise and cloud environments.
- B. Incorrect.
Incorrect. Full-disk encryption protects data at rest from unauthorized offline access, especially for lost or stolen devices, but it does not stop an attacker who already has system access from deleting logs, altering timestamps, or using living-off-the-land binaries. A candidate might choose this because encryption is broadly associated with security and data protection, but it is not a primary control for countering anti-forensic behavior on running systems.
- C. Incorrect.
Incorrect. Longer local retention is helpful for investigations, but if logs remain only on the host and administrators retain broad authority to clear or alter them, the core anti-forensic risk remains. Attackers commonly target local artifacts first. The misconception here is assuming retention alone equals resilience; in reality, evidence availability depends on tamper resistance, least privilege, and off-system preservation.
- D. Incorrect.
Incorrect. Signature-based antivirus can detect some known tools or patterns, but anti-forensic behavior frequently uses native utilities, valid credentials, custom scripts, and low-noise techniques that bypass signatures. Timestomping and log tampering are often identified through behavioral analytics, integrity checks, and externalized logging rather than signatures alone. This option reflects an overly tool-centric approach that does not adequately address evidence preservation.