CHFI Incident Response and First Responder Skills Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a full disk image before taking any other action.

  Why it's wrong here

  Imaging is an essential forensic step, but performing it first while the host remains connected to the network risks continued command-and-control traffic and further data exfiltration during the lengthy acquisition. This also violates the order of volatility because network connections, memory-resident data, and running processes are lost before the disk is copied. A first responder must first physically isolate the system, then preserve volatile data, and only then create a full forensic image.

• ✓

  Disconnect the network cable to isolate the system from the network.

  Why this is correct

  Physically unplugging the network cable is the correct immediate action because it provides an OS-independent isolation that halts command-and-control channels and prevents remote tampering without initiating any shutdown routines. This preserves critical volatile evidence such as active TCP/UDP connections, ARP cache entries, running processes, and memory contents, enabling a later live forensic acquisition. It also stabilizes the host so that subsequent imaging and analysis can be performed in a controlled, defensible manner.

• ✗

  Immediately shut down the system to prevent further data exfiltration.

  Why it's wrong here

  An immediate shutdown destroys the very volatile data that often contains the best evidence of compromise: RAM holds malware payloads, decryption keys, open network sockets, and command-line history, all lost on power-off. A graceful shutdown is even worse because the OS and malware can execute cleanup routines that delete event logs, alter registry keys, or wipe artifacts during shutdown. This does not contain exfiltration; it destroys key evidence and may leave an encrypted disk inaccessible without the memory-resident key.

• ✗

  Run a full antivirus scan to remove the malware.

  Why it's wrong here

  Running an antivirus scan at this point contaminates the evidentiary value of the system: it updates last-access timestamps across the filesystem, quarantines or deletes malware binaries, and can modify registry or restore-point data before any preservation has occurred. Modern malware often lives only in memory or uses kernel-level protection, so a live AV scan may miss it entirely while simultaneously signaling the attacker that they have been discovered. The proper sequence is to preserve volatile memory and disk evidence first, leaving malicious code intact for forensic analysis.

Go deeper

Related to this question