First Response

You are a first responder dispatched to a compromised Windows 10 workstation. The system is still powered on and the user is logged in. Before isolating the machine from the network, you need to capture the current state of active network connections and the processes that own them. Which command should you run first?

You are the first responder assigned to a suspected insider data theft case on a corporate Windows laptop. The machine is powered off and was handed to you by security personnel. Which step should you take first to preserve the integrity of the evidence?

When identifying stakeholders to notify during an incident, which group should be notified first?

During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?

A first responder arrives at a workstation where an employee is suspected of exfiltrating data via a USB device. The machine is powered on with a screensaver active. The responder must capture the current physical memory contents for later analysis. Which action should the responder take first?

During the first response to a compromised Windows workstation, you must capture volatile memory before shutting the system down. Which tool or technique is designed to acquire the full physical memory image while preserving its integrity for later analysis?

Which TWO types of evidence are considered 'volatile'?

When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?

You are the first responder dispatched to a workstation suspected of being compromised by a phishing payload. The user is still logged in and a suspicious process is actively communicating over the network. Before you begin any data collection, what should you do first?

A first responder arrives at a workstation where a user is suspected of exfiltrating data via a USB drive. The machine is still powered on. The responder must preserve the most volatile evidence first. Which artifact should be captured immediately?

What is the 'First Responder Toolkit' used for during an incident?

A first responder is documenting a compromised Linux server. The server's system clock is accurate, but the file timestamps show inconsistencies. The responder needs to preserve the file system metadata for later analysis. Which action should be taken first to ensure the integrity of the metadata?

Which THREE pieces of information should be recorded on a Chain of Custody (CoC) form when collecting a device?

You are a first responder tasked with collecting volatile data from a compromised Windows system. Which two of the following commands or tools are appropriate for capturing network connection information? (Choose two.)

Which TWO items should be part of a first responder's physical toolkit?

You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?

A first responder is preparing to acquire a forensic image of a running Linux server's physical memory. The server has 64 GB of RAM and is critical to business operations. The responder must ensure the integrity of the memory image and minimize disruption. Which of the following is the most appropriate action?

A first responder is called to investigate a suspected malware infection on a Windows workstation. The responder needs to quickly determine which processes are currently running and their associated command-line arguments. Which native Windows tool should the responder use?

You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

A first responder arrives at a workstation that is suspected of being compromised by a Remote Access Trojan (RAT). The user reports the machine has been running slowly and the network activity LED is constantly blinking. The responder decides to capture volatile network connection data before any other action. Which of the following commands should the responder use to display active network connections and the associated process IDs on a Windows system?

You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?

You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?

Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?

Which THREE categories of stakeholders should be considered for notification in a major data breach?

You are handling a ransomware incident. Which step should be taken before attempting any file recovery?

A first responder is collecting evidence from a compromised Windows server. The server is still running, and the responder needs to preserve the current state of network connections and the associated processes. Which command should the responder use to capture this information?

Which of the following is an example of a non-volatile data source?

You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?

You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?

When documenting evidence for a forensic investigation, you are required to establish a chain of custody. Which information is considered mandatory for each entry in the chain of custody log to satisfy legal requirements?

During an incident, a responder needs to capture the ARP cache to identify potential local spoofing. Which tool provides this information?

During the triage of a Linux server, you suspect a rootkit is intercepting system calls. Which THREE actions are appropriate for the first responder to perform to gather evidence of the rootkit?

During a first response to a Linux web server suspected of compromise, you notice that the root account's command history file has been truncated and that the system binaries /bin/ps and /bin/netstat have modification times newer than the kernel package. You must preserve trustworthy evidence. Which action best addresses the integrity concern before you rely on those binaries?

You need to capture forensic data from a Windows machine using a remote agent. What is the risk of using built-in administrative tools like PowerShell for this?

During a forensic investigation of a compromised Linux server, you need to collect volatile data from memory. The server is running critical services and cannot be taken offline. Which method is most appropriate for capturing memory while minimizing disruption?

You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?

You are the first responder to a Linux server that is suspected of being compromised. You need to collect volatile data in the order of volatility. Which command should you run first to capture the most volatile data?

A first responder is called to a small office where an employee's laptop is suspected of being infected with malware. The laptop is powered on and the employee is logged in. The responder needs to preserve the most volatile evidence before any other action. Which of the following should the responder do first?

Which TWO actions are recommended for evidence preservation in a digital incident?

During an incident response engagement, a first responder is collecting volatile data from a compromised Windows server. The responder needs to capture the current network connections, including the process ID associated with each connection, without installing any third-party tools. Which native Windows command should the responder use?

Which THREE pieces of information should be included in an incident triage report?

What is the primary purpose of a write blocker in a forensic investigation?

Which documentation is required when transferring physical evidence from a responder to a forensic lab?

In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?

A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?

While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?

A first responder arrives at a scene where a laptop is suspected to contain evidence of a data breach. The laptop is powered on and logged in. What is the first step the responder should take to preserve volatile evidence?

When notifying stakeholders during a major data breach, which TWO of the following groups must be informed according to standard incident communication plans to satisfy regulatory and operational needs?

A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?

During a first response to a compromised server, you need to capture the contents of RAM. The server is a critical production system that cannot be taken offline. Which factor is most important to consider when selecting a memory acquisition tool for this scenario?

During a network intrusion investigation, a first responder needs to capture volatile network configuration data from a compromised Windows server before it is rebooted. Which command should be used to display the current ARP cache?

A first responder is documenting a compromised Linux server that is still running. The responder needs to record the system's current network state to later identify unauthorized connections and potential data exfiltration. Which two commands should the responder use to capture this volatile information? (Choose two.)

A junior responder arrives at a compromised Windows 10 workstation. Before touching the keyboard, they photograph the screen. The system is still powered on and a suspicious process is visible in Task Manager. The responder's supervisor asks them to capture the most volatile evidence first. Which action should the responder take next?

Which TWO actions are recommended for secure evidence storage?

You are a first responder called to a scene where a laptop is running and logged in. You need to preserve the most volatile evidence. What should you do first?