Be able to triage a live system: identify suspicious connections and processes, capture volatile data in the correct order, contain without destroying evidence, and document every action. The single most important thing is preserving volatile evidence before it is lost.
Start practicing
Incident Response and First Responder Skills — choose a session length
Free · No account required
Domain overview
This domain covers the first responder's role on live Windows and Linux systems: securing the scene, volatile data order of volatility, and documenting actions. CHFI tests it through short scenarios where you pick the correct command, tool, or containment step and justify why it preserves evidence best.
Exam objectives
Running netstat -ano to map PIDs to suspicious outbound C2 connections on Windows
Capturing volatile data in order: memory, network connections, processes, then disk
Using trusted tools and write blockers so live response minimally alters evidence
Isolating a compromised host via network containment while keeping it powered for memory capture
Pulling the plug or shutting down first, destroying volatile memory, network state, and running-process evidence that cannot be recovered later.
Trusting attacker-controlled binaries on the compromised host instead of running commands and tools from verified, read-only external media.
Confusing containment with eradication, or capturing disk before volatile data, violating the order of volatility.
Click any question to see the full explanation and answer options, or start a focused practice session above.
An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?
2A security team suspects a data breach via an external attacker. The incident response plan requires preservation of evidence for legal proceedings. Which order of volatility should the first responder follow?
3During an incident response, a first responder needs to collect evidence from a Linux server that is still running. The server has sensitive data and cannot be shut down. Which technique is BEST for acquiring a forensic image of the hard disk?
4You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?
5A first responder is called to investigate a potential insider threat. The suspect's computer is turned off. What is the BEST procedure?
6During the initial response to a suspected data exfiltration, which THREE pieces of volatile data should be collected first? (Choose three.)
7During incident response, a first responder discovers a compromised system with signs of an active command-and-control (C2) connection. What is the MOST important immediate action to preserve evidence and prevent further damage?
8Refer to the exhibit. During incident response, a first responder runs 'netstat -ano' on a compromised Windows system. Which connection is most likely to be the command-and-control (C2) channel and should be prioritized for isolation?
9You are a first responder for a medium-sized enterprise. The Help Desk received multiple reports that users cannot access the company's internal web application (app.example.com) hosted on a Windows Server 2019 VM. The server is also running a MySQL database and an FTP service for file transfers. You remote into the server and find that the web server (IIS) is still running, but the application pool is stopped. The event logs show multiple failed logon attempts from an external IP address (198.51.100.23) for the local administrator account around the time the issues started. The FTP service log shows successful anonymous logins from the same IP minutes before the web app failure. The MySQL log shows a query 'DROP TABLE users;' executed at 03:15 AM. The current time is 04:00 AM. What immediate action should you take?
10During the initial response to a suspected data breach, a first responder discovers a live system with active network connections. The responder needs to preserve evidence while minimizing alteration. Which of the following is the MOST appropriate first step?
11Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?
12A first responder arrives at a workstation suspected of being compromised by malware that is still running. The user is logged in and a suspicious process is active. The responder needs to capture volatile data before shutting down. Which command should be used first to capture the contents of RAM to a file?
13A first responder is handling a compromised Linux server that is still powered on and actively communicating with an unknown external IP. The responder needs to collect volatile evidence while minimizing disruption. Which TWO actions should be performed to preserve the most volatile data in the correct order? (Choose two.)
14A first responder is called to a scene where a Windows laptop is suspected of being used in a crime. The laptop is turned on and logged in. The responder needs to preserve the most volatile evidence first. Which of the following should be captured first?
15During an incident response, a first responder needs to collect volatile data from a compromised Windows 10 system. The system has PowerShell v5.1 available. Which PowerShell cmdlet should be used to capture a list of currently running processes with their associated command lines?
Deep-dive questions
The most-searched questions in this domain — detailed explanations, worked examples, full answer breakdowns.
Be able to triage a live system: identify suspicious connections and processes, capture volatile data in the correct order, contain without destroying evidence, and document every action. The single most important thing is preserving volatile evidence before it is lost.
The Courseiva CHFI question bank contains 15 questions in the Incident Response and First Responder Skills domain, covering the 8% of the exam attributed to this domain in the official EC-Council blueprint. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Incident Response and First Responder Skills domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included