712-50 Question 389
Single answerDesign anti-forensic techniquesA global financial services company is redesigning its incident response program after a ransomware event in which attackers used anti-forensic methods to delay containment and obscure lateral movement. The CISO wants to prioritize control improvements that specifically reduce the effectiveness of anti-forensic techniques while still supporting legal hold and post-incident investigation requirements. Which control should the CISO prioritize FIRST?
- A
Deploy centrally managed, append-only remote logging and time-synchronized event collection from endpoints, identity systems, and critical servers
- B
Increase endpoint disk encryption coverage across all corporate laptops and servers
- C
Shorten SIEM log retention from 12 months to 30 days to reduce the chance that attackers can discover historical evidence
- D
Rely on host-based logs stored locally because central collection can create a single point of failure
Show answer and explanation
Correct answer: A
Explanation
The best first priority is to make evidence harder for attackers to destroy or manipulate once they compromise a system. Anti-forensic techniques commonly include clearing event logs, deleting tools and temporary files, altering timestamps, disabling telemetry, and tampering with audit configurations. Centralized remote log collection with protected storage directly addresses these risks by preserving copies of events outside the attacker-controlled endpoint. Time synchronization, such as via enterprise NTP practices, further helps defend against timeline manipulation and supports accurate reconstruction.
From a governance and program-design perspective, this choice aligns with established incident logging and monitoring principles in frameworks such as NIST SP 800-61 for incident handling, NIST SP 800-92 for log management, and CIS Controls for centralized audit log collection and retention. It also supports legal and regulatory needs because preserved logs are more defensible for investigations, legal hold, and post-incident reporting. While encryption, local controls, and platform hardening remain valuable, they do not reduce anti-forensic effectiveness as directly as resilient, centralized evidence preservation.
- A. Correct.
Correct. A common anti-forensic tactic is deleting, altering, or timestomping local artifacts to hinder reconstruction of attacker activity. Centrally managed remote logging with write-once or append-only protections materially reduces an attacker’s ability to erase evidence after gaining control of a host. Time synchronization across systems also improves timeline accuracy, which is critical when analyzing anti-forensic behavior intended to confuse sequence of events. Collecting from endpoints, identity platforms, and critical servers gives investigators alternative sources when one host’s evidence has been tampered with.
- B. Incorrect.
Incorrect. Disk encryption is an important security control for protecting data at rest, especially for lost or stolen devices, but it does not directly address attacker anti-forensic actions such as log clearing, artifact deletion, timestomping, or disabling audit trails after compromise. In some investigations, encryption can even complicate access to evidence if key management and response procedures are not mature. This option improves confidentiality, not forensic resilience.
- C. Incorrect.
Incorrect. Reducing retention weakens the organization’s ability to investigate long-dwell intrusions and anti-forensic activity. Attackers often rely on delayed discovery; shorter retention helps them by shrinking the evidence window. Regulatory, legal hold, and incident response best practices generally favor retaining relevant logs long enough to support detection, investigation, and compliance requirements. This option reflects a misunderstanding of the purpose of retention.
- D. Incorrect.
Incorrect. Keeping logs only on the compromised host makes them easier for attackers to modify or destroy. While centralized collection does introduce architectural considerations, the correct response is to design resilience, redundancy, and access control into the logging platform rather than avoid centralization. Depending solely on local logs is precisely the weakness anti-forensic operators exploit.