Courseiva

CCNA Incident Response and First Responder Skills Questions

15 questions · Incident Response and First Responder Skills · All types, answers revealed

Practice these questionsDomain overviewAll questions
1
MCQmedium

A security team suspects a data breach via an external attacker. The incident response plan requires preservation of evidence for legal proceedings. Which order of volatility should the first responder follow?

A.Capture disk image, then memory, then network connections.
B.Record network connections, capture disk image, then memory.
C.Capture memory, record network connections, acquire disk image, then collect backups.
D.Collect backups first, then disk image, then memory.
AnswerC

This is the correct order of volatility: memory first because RAM contains live evidence like decryption keys, running processes, and transient malware that disappears on shutdown; network connections second because they show active command-and-control sessions and can vanish with session teardown; disk image third because persistence preserves it for later analysis; and backups last because they are the least volatile and can be obtained at any time. This sequence maximizes evidence preservation and aligns with RFC 3227 and NIST forensic guidelines, while also supporting a defensible chain of custody.

Why this answer

The order of volatility (OOV) dictates that the most volatile data (memory/registers) must be captured first, followed by network connections, then disk images, and finally backups. This sequence minimizes data loss and ensures evidence integrity for legal proceedings, as volatile data is lost when power is removed.

Exam trap

EC-Council often tests the misconception that disk images are the most critical evidence, leading candidates to prioritize them over volatile memory and network state, which is the exact opposite of the correct order of volatility.

How to eliminate wrong answers

Option A is wrong because it starts with capturing a disk image, which is less volatile than memory and network connections; memory and network state would be lost or altered before the disk is imaged. Option B is wrong because it captures network connections before memory, but memory (RAM) is more volatile and must be acquired first to preserve transient data like running processes and encryption keys. Option D is wrong because it collects backups first, which are the least volatile and can be acquired later; starting with backups risks losing volatile evidence in memory and network connections.

Practice this question →
2
MCQeasy

Refer to the exhibit. A first responder runs the netstat command on a compromised Windows workstation. Which of the following conclusions is BEST supported by the output?

A.The connection to 192.168.1.1:80 is suspicious because it is in TIME_WAIT state.
B.The UDP listener on port 5353 indicates a malware infection.
C.A process with PID 1234 is likely communicating with a remote C2 server at 10.2.3.4.
D.The workstation is running multiple virtual machines based on the local addresses.
AnswerC

PID 1234 holding two established TCP connections to the same remote IP address 10.2.3.4 on different ephemeral source ports is a notable pattern. Established connections indicate active communication, and multiple simultaneous connections to a single remote host—especially if that host is not a known internal server—can represent command-and-control (C2) beaconing or data exfiltration, particularly when the process is unfamiliar or unauthorized. This observation warrants further investigation into the process, its binary, and the remote address's reputation.

Why this answer

An established TCP connection (ESTABLISHED state) from the workstation to a remote IP on a high ephemeral port (49152) with PID 1234 strongly indicates active communication. This is a classic indicator of a beaconing C2 channel, as legitimate outbound connections typically use well-known ports or are short-lived. The netstat output shows PID 1234 has a persistent connection to 10.2.3.4:4444, which is a common port for malware command and control.

Exam trap

EC-Council often tests the misconception that TIME_WAIT or UDP listeners are inherently malicious, when in fact they are normal TCP/IP behaviors; the trap here is to recognize that ESTABLISHED connections to unusual ports with a specific PID are the strongest indicator of active C2 communication.

How to eliminate wrong answers

Option A is wrong because TIME_WAIT state is normal for TCP connections that have been closed; it is not inherently suspicious and is expected after a client finishes an HTTP request to 192.168.1.1:80. Option B is wrong because UDP port 5353 is used by mDNS (RFC 6762) for local network service discovery, a legitimate Windows service, and is not a reliable indicator of malware. Option D is wrong because local addresses like 127.0.0.1 and 0.0.0.0 are loopback and wildcard addresses, not evidence of virtual machines; virtual machines typically have distinct IP addresses on separate virtual network adapters.

Practice this question →
3
MCQmedium

You are responding to a suspected malware infection on a Windows 10 system. The system is still running. Which of the following should you collect FIRST?

A.Acquire a memory dump using a tool like WinPmem.
B.Collect the Windows Event Logs.
C.Export the contents of the Windows Registry.
D.Create a forensic image of the hard drive.
AnswerA

RAM is the most volatile component in a Windows system and must be captured before any other action, because it holds currently running processes, active network sockets, loaded kernel modules, injected code, and plaintext encryption keys. Using WinPmem (or similar tools) creates a raw memory image that can be analyzed for malware artifacts that exist only in volatile memory, such as reflective DLLs or rootkits. Any subsequent step in the incident response workflow will alter memory contents, so the order of volatility dictates that memory acquisition comes first.

Why this answer

When a system is still running and suspected of malware infection, the first priority is to capture volatile data, which includes the contents of RAM. WinPmem is a tool designed to acquire a memory dump from a live Windows system, preserving critical evidence such as running processes, network connections, and injected code that would be lost on shutdown. This follows the order of volatility (RFC 3227), which mandates collecting memory before any non-volatile data like logs, registry, or disk images.

Exam trap

EC-Council often tests the order of volatility (OOV) principle, and the trap here is that candidates mistakenly prioritize persistent data (logs, registry, disk image) over volatile memory, thinking they are more stable or easier to collect first.

How to eliminate wrong answers

Option B is wrong because Windows Event Logs are stored on disk and are non-volatile; collecting them first would risk losing volatile memory evidence if the system crashes or is shut down. Option C is wrong because the Windows Registry is also stored on disk (in hive files like SAM, SYSTEM, SOFTWARE) and is non-volatile; exporting it before memory acquisition violates the order of volatility. Option D is wrong because creating a forensic image of the hard drive is a time-intensive process that captures only non-volatile data, and performing it first would allow volatile evidence (e.g., running malware processes, network connections) to be lost.

Practice this question →
4
MCQmedium

A first responder arrives at a workstation suspected of being compromised by malware that is still running. The user is logged in and a suspicious process is active. The responder needs to capture volatile data before shutting down. Which command should be used first to capture the contents of RAM to a file?

A.winpmem.exe -o memory.raw
B.volatility -f memory.raw imageinfo
C.ftk imager --capture-memory
D.dd if=/dev/mem of=memory.raw
AnswerA

winpmem is a Windows memory acquisition tool that captures physical memory to a raw file. Running it first preserves volatile data before any shutdown or further changes. It is specifically designed for forensic imaging of RAM on live Windows systems and is a standard first-responder tool. Capturing memory with winpmem before other actions aligns with order of volatility principles.

Why this answer

The order of volatility dictates that RAM contents should be captured before any other action. winpmem is a reliable Windows memory acquisition tool that outputs a raw memory file. The other options are either for a different OS, incorrect syntax, or analysis rather than acquisition. Capturing memory first ensures critical volatile evidence such as running processes and network connections is preserved.

Exam trap

The trap here is assuming that analysis tools like Volatility can acquire memory or that Linux commands work on Windows, when acquisition must be done with a dedicated Windows memory capture utility first.

Practice this question →
5
MCQeasy

An analyst receives an alert indicating a suspicious process (PID 3342) is making outbound connections on port 443 to an unknown IP. The system is a Windows 10 workstation. Which first responder action is MOST appropriate?

A.Capture a full memory dump using a tool like FTK Imager (Memory Capture) or DumpIt.
B.Immediately disconnect the system from the network to contain the threat.
C.Check the Windows Event Logs for related entries.
D.Reboot the system to clear any malicious processes from memory.
AnswerA

Capturing a full memory dump with FTK Imager (Memory Capture) or DumpIt preserves the entire contents of RAM, including running processes, loaded drivers, active network sockets, decrypted data, and injected code that exist only in volatile memory at that instant. This adheres to the order of volatility and allows analysis of the live system state without altering or destroying it. Memory imaging is the highest-priority step because many advanced threats operate solely in memory and leave minimal traces on disk.

Why this answer

Capturing a full memory dump (option A) is the most appropriate first responder action because it preserves the volatile state of the suspicious process (PID 3342) and its associated artifacts (e.g., network connections, loaded DLLs, encryption keys) before any further system changes occur. This allows forensic analysis to identify the malware's behavior, such as command-and-control (C2) communication over port 443 (HTTPS), without altering evidence. Tools like FTK Imager (Memory Capture) or DumpIt acquire a raw .mem file that can be analyzed with Volatility or Rekall to extract process details, network sockets, and injected code.

Exam trap

EC-Council often tests the principle that volatile data (memory) must be captured before any containment or analysis steps, and the trap here is that candidates mistakenly prioritize network containment (option B) over evidence preservation, forgetting that disconnecting the network can destroy critical volatile artifacts like active connections and encryption keys.

How to eliminate wrong answers

Option B is wrong because immediately disconnecting the system from the network may destroy volatile evidence (e.g., active TCP connections, ARP cache, and network session data) and could alert the attacker, potentially triggering anti-forensic measures like process termination or data encryption. Option C is wrong because checking Windows Event Logs is a secondary step that should occur after memory capture; event logs may not contain real-time process details (e.g., memory-resident code) and can be tampered with or cleared by the malware. Option D is wrong because rebooting the system destroys all volatile memory (RAM), including the suspicious process (PID 3342), network connections, and any decrypted payloads, making forensic recovery of the attack impossible.

Practice this question →
6
MCQeasy

Refer to the exhibit. During incident response, a first responder runs 'netstat -ano' on a compromised Windows system. Which connection is most likely to be the command-and-control (C2) channel and should be prioritized for isolation?

A.192.168.1.100:1045 to 203.0.113.5:4444 (ESTABLISHED)
B.192.168.1.100:1047 to 10.0.0.1:22 (ESTABLISHED)
C.192.168.1.100:1046 to 192.168.1.1:443 (ESTABLISHED)
D.192.168.1.100:1048 to 198.51.100.7:80 (TIME_WAIT)
AnswerA

The established connection from the internal host to 203.0.113.5 on TCP port 4444 is a classic command-and-control indicator: port 4444 is the default listener port for Metasploit's Meterpreter reverse shell, and the destination is an external IP address that would not be in any internal allowlist. The ESTABLISHED state confirms an active, ongoing session, meaning the attacker likely already has a foothold and is maintaining control of the host. Moreover, 203.0.113.0/24 is a documentation range (TEST-NET-3), so its appearance in real traffic should immediately raise suspicion.

Why this answer

Shows an established connection from the internal host (192.168.1.100) to an external IP (203.0.113.5) on TCP port 4444, which is commonly associated with Metasploit reverse shells and other C2 frameworks. The ESTABLISHED state indicates an active, ongoing session, making it the highest priority for isolation during incident response.

Exam trap

EC-Council often tests the misconception that any external connection is suspicious, but the trap here is that candidates overlook the significance of the ESTABLISHED state and the specific port 4444, instead focusing on the IP address alone or mistaking a TIME_WAIT connection for an active threat.

How to eliminate wrong answers

Option B is wrong because port 22 is SSH, which is typically used for legitimate remote administration; while it could be abused, it is less likely than a non-standard high port like 4444 to be a C2 channel. Option C is wrong because 192.168.1.1:443 is a local gateway HTTPS connection, likely normal web traffic to the default gateway or a local proxy, not an external C2. Option D is wrong because the connection is in TIME_WAIT state, meaning it has already been closed and is not actively communicating, so it cannot be an active C2 channel.

Practice this question →
7
MCQmedium

During the initial response to a suspected data breach, a first responder discovers a live system with active network connections. The responder needs to preserve evidence while minimizing alteration. Which of the following is the MOST appropriate first step?

A.Use a memory acquisition tool to capture the contents of RAM.
B.Run a full disk imaging tool to capture the hard drive contents.
C.Disconnect the network cable to isolate the system from the network.
D.Immediately shut down the system by pulling the power cord.
AnswerA

A memory acquisition tool (e.g., WinPmem, DumpIt, or FTK Imager's memory capture) preserves the volatile data that defines the system's live state: running processes, loaded kernel modules, open network sockets, unencrypted credentials, and memory-resident malware. This is the first step in RFC 3227's volatility order because every subsequent action—including disk imaging, network isolation, or powering off—will alter or destroy these transient artifacts, leaving the investigation without the most probative evidence of the breach.

Why this answer

A is correct because in a live system with active network connections, the most volatile evidence is in RAM (e.g., running processes, network connections, encryption keys). Using a memory acquisition tool (like FTK Imager or WinPmem) captures this volatile data before any other action, preserving evidence that would be lost on shutdown or disconnection. This aligns with the order of volatility (RFC 3227), which prioritizes memory over disk.

Exam trap

The CHFI exam often tests the misconception that disconnecting the network or shutting down is the safest first step, but the trap here is that volatile memory is the most critical evidence and must be captured before any action that could alter or destroy it.

How to eliminate wrong answers

Option B is wrong because running a full disk imaging tool first would overwrite unallocated space and modify system metadata (e.g., last access times), altering evidence; it also ignores the higher volatility of RAM. Option C is wrong because disconnecting the network cable may terminate active connections and cause the system to lose volatile data (e.g., network state, encryption keys), and it can trigger anti-forensic scripts that wipe evidence. Option D is wrong because immediately shutting down by pulling the power cord destroys all volatile memory (RAM), including running processes and network connections, and can corrupt disk data due to unclean shutdown.

Practice this question →
8
MCQmedium

During incident response, a first responder discovers a compromised system with signs of an active command-and-control (C2) connection. What is the MOST important immediate action to preserve evidence and prevent further damage?

A.Create a full disk image before taking any other action.
B.Disconnect the network cable to isolate the system from the network.
C.Immediately shut down the system to prevent further data exfiltration.
D.Run a full antivirus scan to remove the malware.
AnswerB

Physically unplugging the network cable is the correct immediate action because it provides an OS-independent isolation that halts command-and-control channels and prevents remote tampering without initiating any shutdown routines. This preserves critical volatile evidence such as active TCP/UDP connections, ARP cache entries, running processes, and memory contents, enabling a later live forensic acquisition. It also stabilizes the host so that subsequent imaging and analysis can be performed in a controlled, defensible manner.

Why this answer

Disconnecting the network cable immediately stops the active C2 communication, preventing further data exfiltration and command injection while preserving the current state of memory and disk. This action maintains the integrity of volatile evidence (e.g., network connections, running processes) and avoids the data loss that would occur with a shutdown or the evidence contamination that would result from running a scan.

Exam trap

EC-Council often tests the misconception that a full disk image is always the first priority, but in an active C2 scenario, network isolation must come first to prevent ongoing damage and preserve volatile evidence.

How to eliminate wrong answers

Option A is wrong because creating a full disk image before isolating the system allows the active C2 connection to continue exfiltrating data and potentially destroying evidence during the imaging process. Option C is wrong because immediately shutting down the system destroys volatile evidence (e.g., network connections, running processes, memory-resident malware) and may trigger anti-forensic mechanisms that wipe logs or encrypt data. Option D is wrong because running a full antivirus scan modifies the system state (e.g., file access times, registry keys) and may alert the attacker, causing them to terminate the C2 session or trigger a kill switch, thereby losing evidence of the active connection.

Practice this question →
9
MCQhard

During an incident response, a first responder needs to collect volatile data from a compromised Windows 10 system. The system has PowerShell v5.1 available. Which PowerShell cmdlet should be used to capture a list of currently running processes with their associated command lines?

A.Get-Process | Where-Object {$_.CommandLine -ne $null}
B.Get-CimInstance Win32_Process | Select-Object Name, ProcessId, CommandLine
C.Get-WmiObject -Class Win32_Process | Export-Csv processes.csv
D.Get-Process | Format-List *
AnswerB

Get-CimInstance Win32_Process retrieves process information including the CommandLine property, which shows the full command used to start each process. Selecting Name, ProcessId, and CommandLine provides a clear, concise list. This is essential for identifying malicious processes with suspicious arguments. It is a reliable method on Windows 10 with PowerShell v5.1.

Why this answer

The Win32_Process CIM class includes the CommandLine property, which reveals the full command line for each process. Using Get-CimInstance with Select-Object for Name, ProcessId, and CommandLine provides a precise and efficient capture. Other options either lack command-line data or use deprecated cmdlets.

This approach is reliable and non-intrusive for volatile data collection.

Exam trap

The trap here is assuming that Get-Process returns command-line arguments, when in fact it does not; command lines require querying the Win32_Process class via CIM or WMI.

Practice this question →
10
MCQeasy

A first responder is called to a scene where a Windows laptop is suspected of being used in a crime. The laptop is turned on and logged in. The responder needs to preserve the most volatile evidence first. Which of the following should be captured first?

A.The contents of RAM
B.The event logs
C.The Windows Registry
D.The pagefile.sys file
AnswerA

RAM contains the most volatile data, including running processes, network connections, and encryption keys. It is lost when the system is powered off. Capturing RAM first aligns with the order of volatility and ensures critical evidence is preserved. This is a fundamental first-responder principle for live systems.

Why this answer

The order of volatility dictates that RAM is the most volatile and should be captured first. Registry, pagefile, and event logs are stored on disk and persist after shutdown, making them less volatile. Capturing RAM first ensures that running processes, network connections, and potentially encryption keys are preserved before any other action.

Exam trap

The trap here is assuming that disk-based artifacts like the registry or event logs are more volatile than RAM, when actually RAM is lost immediately upon power-off.

Practice this question →
11
MCQeasy

A first responder is called to investigate a potential insider threat. The suspect's computer is turned off. What is the BEST procedure?

A.Compute a hash of the hard drive using a live CD.
B.Check the power cord and peripherals for tampering.
C.Seize the computer and transport it to a forensic lab for imaging.
D.Turn on the computer to see if it boots normally.
AnswerC

Seizing the computer and transporting it to a forensic lab preserves the original evidence for a proper bit-for-bit image using a write-blocker, ensuring data integrity and admissibility. A controlled lab environment allows for secure storage and careful analysis before any acquisition, maintaining a documented chain of custody from the scene onward. This is the recognized best practice for first responders.

Why this answer

When a suspect's computer is already turned off, the best procedure is to seize it and transport it to a forensic lab for imaging. This preserves the integrity of the evidence by preventing any accidental modification of the hard drive's contents, which could occur if the system is powered on or booted from a live CD. In forensic best practices, the first responder should never boot a suspect's computer, as doing so can alter critical system files, timestamps, and volatile data, compromising the chain of custody and admissibility of evidence.

Exam trap

EC-Council often tests the misconception that booting from a live CD is safe because it doesn't touch the hard drive, but in reality, even a live CD can modify the system's registry, page file, or metadata through normal operation, which is why seizing the computer for lab imaging is the only forensically sound option.

How to eliminate wrong answers

Option A is wrong because computing a hash of the hard drive using a live CD requires booting the suspect's computer, which alters the system state (e.g., writes to the page file, updates last access times) and violates the forensic principle of not modifying evidence. Option B is wrong because checking the power cord and peripherals for tampering is a physical inspection step that, while potentially useful, is not the best procedure; the priority is to secure the digital evidence by seizing the computer intact. Option D is wrong because turning on the computer to see if it boots normally will immediately alter the hard drive's contents (e.g., writing to the registry, updating logs, modifying file timestamps), destroying potential evidence and violating the forensic requirement to preserve the original state.

Practice this question →
12
Multi-Selecthard

During the initial response to a suspected data exfiltration, which THREE pieces of volatile data should be collected first? (Choose three.)

Select 3 answers
A.Current network connections.
B.List of running processes.
C.Contents of system memory (RAM).
D.Windows registry hives.
E.Forensic image of the hard drive.
AnswersA, B, C

Network connections are transient and may disappear.

Why this answer

Current network connections (A) are volatile because they show active communication channels that could indicate data exfiltration in progress. If the system is shut down or disconnected, this evidence is lost immediately, making it a top priority for collection during initial response.

Exam trap

EC-Council often tests the Order of Volatility principle, and the trap here is that candidates mistakenly prioritize persistent data like registry hives or disk images over transient evidence that disappears immediately upon shutdown.

Practice this question →
13
Multi-Selecthard

A first responder is handling a compromised Linux server that is still powered on and actively communicating with an unknown external IP. The responder needs to collect volatile evidence while minimizing disruption. Which TWO actions should be performed to preserve the most volatile data in the correct order? (Choose two.)

Select 2 answers
A.Run 'netstat -antp' to capture current network connections and associated processes.
B.Immediately pull the power plug to prevent further data exfiltration.
C.Run 'chmod -R 000 /var/log' to protect log files from tampering.
D.Run 'ps aux' to capture the list of running processes.
E.Run 'dd if=/dev/sda of=/mnt/external/disk.img' to image the entire disk.
AnswersA, D

Capturing network connections and associated processes is a high-priority volatile data source. netstat -antp shows active TCP connections, listening ports, and the PID/program name, which can reveal command-and-control channels. This should be done before any shutdown or service restart, as the information disappears once connections close. It aligns with the order of volatility by capturing network state early.

Why this answer

The most volatile data on a running Linux system includes network connections and running processes. Capturing netstat -antp and ps aux first preserves this time-sensitive evidence. Full disk imaging and permission changes are either non-volatile or destructive and should not be performed before volatile data is secured.

Following the order of volatility ensures critical evidence is not lost.

Exam trap

The trap here is thinking that pulling the plug or imaging the disk first is acceptable, when volatile network and process data must be captured before any such actions.

Practice this question →
14
MCQhard

During an incident response, a first responder needs to collect evidence from a Linux server that is still running. The server has sensitive data and cannot be shut down. Which technique is BEST for acquiring a forensic image of the hard disk?

A.Use dd if=/dev/sda of=/mnt/evidence/image.dd conv=noerror,sync
B.Use dd if=/dev/sda of=/mnt/evidence/image.dd bs=4M
C.Use dd if=/dev/mapper/root of=/mnt/evidence/image.dd
D.Use dd if=/dev/sda1 of=/mnt/evidence/image.dd
AnswerB

Imaging the entire block device /dev/sda with bs=4M captures the complete physical disk, including the master boot record, partition tables, each partition, and unallocated space. The bs=4M argument is only a performance optimization that increases the read/write buffer size; it does not change the output data, so the result is still a bit-for-bit forensically sound copy. This is the correct first-responder action because it preserves all potential evidence on the drive.

Why this answer

It uses dd with a 4M block size, which improves acquisition speed while still producing a bit-for-bit forensic image of the entire disk (/dev/sda). The conv=noerror,sync option in A is unnecessary for a live acquisition from a healthy disk and can mask read errors, while B's larger block size is more efficient for imaging a running system without shutdown.

Exam trap

EC-Council often tests the misconception that conv=noerror,sync is always required for forensic imaging, but in a live, healthy server scenario, it can introduce artifacts and is not the best practice.

How to eliminate wrong answers

Option A is wrong because conv=noerror,sync pads bad blocks with zeros, which can hide read errors and corrupt the forensic integrity of the image; it is typically used for failing disks, not for a live, healthy server. Option C is wrong because /dev/mapper/root targets a logical volume (LVM) rather than the physical disk, missing partition tables, boot sectors, and unallocated space essential for a complete forensic image. Option D is wrong because /dev/sda1 is only the first partition, not the entire disk, so it omits other partitions, MBR/GPT, and unallocated areas.

Practice this question →
15
MCQmedium

You are a first responder for a medium-sized enterprise. The Help Desk received multiple reports that users cannot access the company's internal web application (app.example.com) hosted on a Windows Server 2019 VM. The server is also running a MySQL database and an FTP service for file transfers. You remote into the server and find that the web server (IIS) is still running, but the application pool is stopped. The event logs show multiple failed logon attempts from an external IP address (198.51.100.23) for the local administrator account around the time the issues started. The FTP service log shows successful anonymous logins from the same IP minutes before the web app failure. The MySQL log shows a query 'DROP TABLE users;' executed at 03:15 AM. The current time is 04:00 AM. What immediate action should you take?

A.Capture a memory dump of the server, then disconnect the network cable, and then image the hard drive.
B.Disconnect the server from the network and then restore the database from the last clean backup.
C.Immediately shut down the server to prevent further damage and then create a forensic image of the hard drive.
D.Run a full antivirus scan, then try to restart the application pool to restore service quickly.
AnswerA

Capture a memory dump first because RAM holds the most volatile evidence—running processes, open network sockets, loaded kernel modules, and decrypted data—all of which vanish on power loss. Disconnecting the network cable immediately after memory acquisition cuts off remote attacker access and prevents further tampering with disk evidence. Finally, imaging the hard drive preserves the static data in a forensically sound, bit-for-bit copy for later analysis. The strict ordering follows the volatility hierarchy, ensuring no evidence layer is destroyed before it is captured.

Why this answer

The server is actively compromised — the attacker gained access via anonymous FTP, executed a destructive SQL query, and performed lateral movement. Capturing a memory dump preserves volatile evidence (e.g., running processes, network connections, and in-memory malware), disconnecting the network cable prevents further data exfiltration or remote control, and imaging the hard drive captures persistent evidence. This follows the CHFI first responder priority: preserve volatile data first, then isolate, then acquire non-volatile evidence.

Exam trap

EC-Council often tests the first responder's priority order — candidates mistakenly choose to shut down or restore services first, forgetting that volatile evidence (memory, network connections) is lost on power-off and that isolation must precede any remediation.

How to eliminate wrong answers

Option B is wrong because restoring the database from backup destroys volatile evidence (e.g., memory-resident malware, active network connections) and may re-infect the system if the backup is compromised; isolation must precede restoration. Option C is wrong because shutting down the server destroys volatile data (e.g., running processes, network connections, encryption keys in memory) and may trigger anti-forensic mechanisms; the correct order is memory capture before power-off. Option D is wrong because running an antivirus scan modifies the system state (e.g., file access times, quarantine actions) and may alert the attacker if they have remote access; service restoration is premature before forensic preservation.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Incident Response and First Responder Skills questions.

Start 20-question session