You are using EnCase Endpoint Investigator to triage a suspicious endpoint. You need to identify unauthorized processes currently running. Which feature should you utilize?
You are responding to an incident involving a compromised Windows server. You need to collect volatile data using a trusted toolkit. Which tool is standard for collecting running services and loaded DLLs?
As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?
You are handling a database compromise. The database logs show evidence of SQL injection. What is the appropriate initial containment step for the database?
You are triaging a compromised Windows workstation. Using the Volatility 3 framework, you need to identify hidden processes that may be indicative of a rootkit. Which command-line plugin provides the most direct evidence of process hiding by comparing the process list from the EPROCESS block against the thread scheduler list?
During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?
You are managing a live incident and need to preserve the network state of a Linux server. You must capture active network connections and the routing table. Which tool and flag combination is preferred by first responders to ensure minimal impact on the target system's binary integrity?
You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?
You are assembling a 'First Responder Toolkit' for a remote incident team. Which THREE items are essential for collecting volatile data and ensuring legal defensibility on a Windows system?
A first responder is preparing to collect evidence from a compromised laptop that is still powered on. The responder must ensure that the evidence will be admissible in a court of law. Which TWO actions should the responder take to maintain the integrity of the evidence? (Choose two.)
During an incident involving a compromised domain controller, you need to collect volatile data from memory. The server is running critical authentication services and cannot be restarted. Which tool should you use to capture the memory image without disrupting operations?
A first responder is preparing to collect volatile data from a compromised Windows workstation. Which TWO actions should be performed to maintain the integrity of the evidence? (Choose two.)
A first responder is called to investigate a suspected insider threat on a Linux server. The server is still running, and the responder needs to identify which user accounts are currently logged in and from which IP addresses. Which command should be used?
You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?
You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?
You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?
A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?
You need to capture forensic data from a Windows machine using a remote agent. What is the risk of using built-in administrative tools like PowerShell for this?
You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?
In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?
When documenting evidence for a forensic investigation, you are required to establish a chain of custody. Which information is considered mandatory for each entry in the chain of custody log to satisfy legal requirements?
During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?
When notifying stakeholders during a major data breach, which TWO of the following groups must be informed according to standard incident communication plans to satisfy regulatory and operational needs?
During the triage of a Linux server, you suspect a rootkit is intercepting system calls. Which THREE actions are appropriate for the first responder to perform to gather evidence of the rootkit?
A first responder arrives at a workstation where an employee is suspected of exfiltrating data via a USB device. The machine is powered on with a screensaver active. The responder must capture the current physical memory contents for later analysis. Which action should the responder take first?
During the first response to a compromised Windows workstation, you must capture volatile memory before shutting the system down. Which tool or technique is designed to acquire the full physical memory image while preserving its integrity for later analysis?
During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?
You are the first responder dispatched to a workstation suspected of being compromised by a phishing payload. The user is still logged in and a suspicious process is actively communicating over the network. Before you begin any data collection, what should you do first?
You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?
A first responder arrives at a workstation where a user is suspected of exfiltrating data via a USB drive. The machine is still powered on. The responder must preserve the most volatile evidence first. Which artifact should be captured immediately?
You are a first responder called to a scene where a laptop is running and logged in. You need to preserve the most volatile evidence. What should you do first?
During a forensic investigation of a compromised Linux server, you need to collect volatile data from memory. The server is running critical services and cannot be taken offline. Which method is most appropriate for capturing memory while minimizing disruption?
During a network intrusion investigation, a first responder needs to capture volatile network configuration data from a compromised Windows server before it is rebooted. Which command should be used to display the current ARP cache?
A first responder arrives at a scene where a laptop is suspected to contain evidence of a data breach. The laptop is powered on and logged in. What is the first step the responder should take to preserve volatile evidence?
You are a first responder tasked with collecting volatile data from a compromised Windows system. Which two of the following commands or tools are appropriate for capturing network connection information? (Choose two.)
A junior responder arrives at a compromised Windows 10 workstation. Before touching the keyboard, they photograph the screen. The system is still powered on and a suspicious process is visible in Task Manager. The responder's supervisor asks them to capture the most volatile evidence first. Which action should the responder take next?
A first responder is documenting a compromised Linux server. The server's system clock is accurate, but the file timestamps show inconsistencies. The responder needs to preserve the file system metadata for later analysis. Which action should be taken first to ensure the integrity of the metadata?
During a first response to a compromised server, you need to capture the contents of RAM. The server is a critical production system that cannot be taken offline. Which factor is most important to consider when selecting a memory acquisition tool for this scenario?
A first responder is called to investigate a suspected malware infection on a Windows workstation. The responder needs to quickly determine which processes are currently running and their associated command-line arguments. Which native Windows tool should the responder use?
A first responder is documenting a compromised Linux server that is still running. The responder needs to record the system's current network state to later identify unauthorized connections and potential data exfiltration. Which two commands should the responder use to capture this volatile information? (Choose two.)
A first responder is called to a small office where an employee's laptop is suspected of being infected with malware. The laptop is powered on and the employee is logged in. The responder needs to preserve the most volatile evidence before any other action. Which of the following should the responder do first?
A first responder is collecting evidence from a compromised Windows server. The server is still running, and the responder needs to preserve the current state of network connections and the associated processes. Which command should the responder use to capture this information?
A first responder is preparing to acquire a forensic image of a running Linux server's physical memory. The server has 64 GB of RAM and is critical to business operations. The responder must ensure the integrity of the memory image and minimize disruption. Which of the following is the most appropriate action?
A first responder arrives at a workstation that is suspected of being compromised by a Remote Access Trojan (RAT). The user reports the machine has been running slowly and the network activity LED is constantly blinking. The responder decides to capture volatile network connection data before any other action. Which of the following commands should the responder use to display active network connections and the associated process IDs on a Windows system?
You are a first responder dispatched to a compromised Windows 10 workstation. The system is still powered on and the user is logged in. Before isolating the machine from the network, you need to capture the current state of active network connections and the processes that own them. Which command should you run first?
During a first response to a Linux web server suspected of compromise, you notice that the root account's command history file has been truncated and that the system binaries /bin/ps and /bin/netstat have modification times newer than the kernel package. You must preserve trustworthy evidence. Which action best addresses the integrity concern before you rely on those binaries?
You are the first responder assigned to a suspected insider data theft case on a corporate Windows laptop. The machine is powered off and was handed to you by security personnel. Which step should you take first to preserve the integrity of the evidence?