CHFI Incident Response and First Responder Skills Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Capture a memory dump of the server, then disconnect the network cable, and then image the hard drive.

  Why this is correct

  Capture a memory dump first because RAM holds the most volatile evidence—running processes, open network sockets, loaded kernel modules, and decrypted data—all of which vanish on power loss. Disconnecting the network cable immediately after memory acquisition cuts off remote attacker access and prevents further tampering with disk evidence. Finally, imaging the hard drive preserves the static data in a forensically sound, bit-for-bit copy for later analysis. The strict ordering follows the volatility hierarchy, ensuring no evidence layer is destroyed before it is captured.

• ✗

  Disconnect the server from the network and then restore the database from the last clean backup.

  Why it's wrong here

  While isolating the server from the network is a correct containment step, restoring the database from backup is a destructive action that overwrites the current disk state—including transaction logs, error logs, and any malicious artifacts left by the intrusion. It also skips memory acquisition entirely, so evidential data in RAM, such as active malware processes or live network connections, is lost. A backup restore is a remediation step that may even reintroduce system weaknesses or fail to eliminate attacker persistence if other parts of the system remain compromised. In forensic terms, you are destroying primary evidence before it has been preserved.

• ✗

  Immediately shut down the server to prevent further damage and then create a forensic image of the hard drive.

  Why it's wrong here

  Immediate shutdown is contraindicated because it destroys volatile evidence: RAM contents, active TCP connections, and process memory all disappear when power is cut, and the OS may also write residual data to the pagefile or update timestamps during the shutdown sequence. Creating a forensic image after shutdown captures only the static disk, which for a memory-resident attack may be completely clean or missing the in-memory payload. While preserving the hard drive is necessary, performing it after a shutdown means the most critical evidential layer has already been lost. The correct approach is to acquire memory first, then isolate the host, then image the disk.

• ✗

  Run a full antivirus scan, then try to restart the application pool to restore service quickly.

  Why it's wrong here

  Running an antivirus scan on a live compromised server is an 'active response' that changes the very evidence you need: scanning updates file access times, quarantines or deletes suspicious executables, and can alter logs, making later forensic reconstruction unreliable. Restarting the application pool forcibly terminates worker processes, which wipes in-memory attack indicators and may allow the attacker to regain entry if the underlying vulnerability is unpatched. This course of action prioritizes rapid service restoration over evidence preservation, yet it fails even as remediation because it does not identify or remove the attacker's foothold. In incident response, never run third-party tools on a system that may be evidence until a forensic copy has been made.

Go deeper

Related to this question