41 questions · First Response · All types, answers revealed
When identifying stakeholders to notify during an incident, which group should be notified first?
Activation of the response team is the first step in the formal process.
Why this answer
The technical incident response team must be activated immediately to manage the incident.
During initial triage, you identify that a system's time is significantly out of sync with the NTP server. Why is this critical to record during the first response?
Inaccurate clocks make log correlation nearly impossible without a known time offset.
Why this answer
Timeline analysis is central to IR; inaccurate system clocks will misrepresent the sequence of events in logs.
Which TWO types of evidence are considered 'volatile'?
Memory is the most volatile evidence.
Why this answer
RAM and network connections are lost when power is removed or the system is reset.
You have identified an active C2 beacon on a corporate server. You are instructed to implement 'Containment' via network segmentation. Which configuration change on a Cisco ASA firewall provides the most effective containment while still allowing for remote forensic forensic analysis?
This allows the responder to maintain access while stopping the C2 communication and lateral movement.
Why this answer
Creating a restrictive ACL that allows only the IR team's management IP to access the compromised server while blocking all other traffic is the best practice for controlled containment.
When investigating an incident on a virtualized platform (VMware), what is the first step to capture the state of the VM for analysis?
This preserves both the disk and the RAM in a single, forensic-ready package.
Why this answer
Taking a VM snapshot captures the memory and disk state of the VM, which is the equivalent of a live acquisition.
What is the 'First Responder Toolkit' used for during an incident?
The kit ensures data integrity and consistency.
Why this answer
A first responder toolkit provides pre-configured, trusted tools for incident triage and data collection.
Which THREE pieces of information should be recorded on a Chain of Custody (CoC) form when collecting a device?
Ensures the correct item is tracked.
Why this answer
CoC must track who collected it, when, and where it came from.
Which TWO items should be part of a first responder's physical toolkit?
Used for off-system collection of evidence.
Why this answer
A write blocker and a bootable forensic drive are essential for physical evidence collection.
You are investigating a Linux server breach. You need to capture the current state of network connections without altering the evidence. Which command-line tool is preferred by first responders?
'ss -tupn' shows TCP/UDP connections, processes, and numeric addresses without resolving names.
Why this answer
'ss' (socket statistics) or 'netstat' is used to view network connections, but 'ss' is modern and more efficient for incident response.
You are responding to a web-based attack. Which log source is most critical for identifying the origin of a SQL injection attempt?
These logs capture the HTTP requests containing malicious input.
Why this answer
Web server access logs contain the request methods and query strings used to deliver the attack payload.
You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?
Operating systems often mount devices and update last access times or index files.
Why this answer
Connecting a mobile device without a physical or software write blocker can lead to automatic synchronization or data modification by the host OS.
You are investigating a suspected rootkit. Which area of the operating system should you examine for unauthorized boot-time execution?
Bootkits/rootkits often modify the MBR to gain control before the OS loads.
Why this answer
The Master Boot Record (MBR) or the EFI partition are common targets for rootkits that persist across reboots.
You are documenting an incident and need to record the time of the event. Why is accurate time synchronization critical?
Log correlation is impossible without synchronized timestamps.
Why this answer
Correlation of logs across different systems requires synchronized clocks, typically via NTP.
When documenting the chain of custody for a seized laptop, which information is mandatory?
Accurate identification via serial number is essential for legal evidence handling.
Why this answer
A chain of custody must include the identity of the person collecting the evidence, the time/date, and the specific location of the item.
Which TWO criteria must a first responder satisfy when choosing a tool for a toolkit?
Minimizing the footprint is a primary forensic requirement.
Why this answer
Tools must be trusted and cause minimal impact on the subject system.
A user reports a 'missing' file that was present earlier. What is the first thing you should check in a forensic triage?
This provides definitive proof of what happened to the file.
Why this answer
Checking the file system journals or event logs (Event ID 4663 for file deletion) is the first step to understand if a file was deleted.
Which THREE categories of stakeholders should be considered for notification in a major data breach?
Legal must be involved for liability and notification requirements.
Why this answer
Legal, IT Management, and the Privacy Officer are critical stakeholders during a breach.
You are handling a ransomware incident. Which step should be taken before attempting any file recovery?
This allows for analysis of the malware and potential recovery of keys.
Why this answer
It is critical to preserve the existing state for potential forensic analysis or decryptor key extraction before trying to recover files.
Which of the following is an example of a non-volatile data source?
Storage drives retain data after power is removed.
Why this answer
Hard drives and flash storage are non-volatile because they retain data when power is removed.
You are performing initial containment on a cloud-based AWS EC2 instance. The instance is under a DDoS attack. What is the most effective way to isolate this specific resource?
This isolates the instance while preserving the running state for memory capture.
Why this answer
Modifying the Security Group to deny all ingress and egress is the fastest way to isolate the instance at the network level in AWS.
You are performing a triage on a server and see unauthorized outbound connections to a foreign IP. What is the best way to determine which process initiated the connection?
This shows the Process ID (PID) responsible for the connection.
Why this answer
'netstat -ano' or 'lsof -i' are used, but specifically 'netstat -ano' associates the PID with the connection.
You are assembling a 'First Responder Toolkit' for a remote incident team. Which THREE items are essential for collecting volatile data and ensuring legal defensibility on a Windows system?
Required for maintaining a defensible chain of custody.
Why this answer
To preserve evidence, you need a write-blocker for disks, a trusted forensic toolkit for memory, and tamper-evident storage.
You discover a suspicious scheduled task on a server. Which Windows tool allows you to export this task for analysis without relying on the GUI?
This command provides a verbose output of all scheduled tasks for analysis.
Why this answer
The 'schtasks' command-line tool is the standard way to query and manage tasks in Windows without triggering GUI-based auditing changes.
When documenting evidence for a forensic investigation, you are required to establish a chain of custody. Which information is considered mandatory for each entry in the chain of custody log to satisfy legal requirements?
This fulfills the legal definition of maintaining an unbroken chain of custody.
Why this answer
Legal standards require clear documentation of who handled the evidence, when, and the specific action taken.
During an incident, a responder needs to capture the ARP cache to identify potential local spoofing. Which tool provides this information?
This displays the current ARP cache entries.
Why this answer
The 'arp -a' command shows the current Address Resolution Protocol cache on a Windows or Linux system.
During the triage of a Linux server, you suspect a rootkit is intercepting system calls. Which THREE actions are appropriate for the first responder to perform to gather evidence of the rootkit?
This detects binary-based rootkits that replace common utilities like 'ps' or 'netstat'.
Why this answer
Collecting memory, inspecting binary integrity, and reviewing kernel modules are key methods for detecting rootkits.
As a first responder, you arrive at a compromised workstation showing signs of active malware beaconing. Which action should be performed first according to the Order of Volatility?
Capturing volatile RAM is the highest priority in the Order of Volatility.
Why this answer
Memory (RAM) is the most volatile component and must be captured before it is overwritten or lost during a shutdown.
You need to capture forensic data from a Windows machine using a remote agent. What is the risk of using built-in administrative tools like PowerShell for this?
Using native tools modifies system logs, which can complicate the investigation.
Why this answer
Native tools leave extensive traces in the event logs and process history, which might overwrite evidence or alert the attacker.
You are analyzing an incident where a user account is being used to exfiltrate data. What is the most immediate action to contain the account?
Invalidating sessions ensures the attacker is kicked out immediately.
Why this answer
Disabling the account is the standard containment measure to stop an active session or further logins.
Which TWO actions are recommended for evidence preservation in a digital incident?
Hashing is the standard for ensuring evidence integrity.
Why this answer
Hashing ensures integrity, and chain of custody ensures legal admissibility.
Which THREE pieces of information should be included in an incident triage report?
This is critical for establishing the incident timeline.
Why this answer
Triage reports should focus on impact, scope, and initial findings.
During a suspected ransomware incident, you are using EnCase Endpoint to perform remote triage. You need to collect volatile data without triggering the ransomware's anti-forensic triggers. Which action should you take first to ensure the integrity of evidence?
RAM capture must happen first to preserve state-dependent evidence before the system is altered.
Why this answer
Capturing volatile data (RAM) before any other forensic action is standard practice as it is the most fragile evidence.
What is the primary purpose of a write blocker in a forensic investigation?
Preservation of evidence integrity is the primary goal.
Why this answer
A write blocker prevents any data from being written to the source drive, ensuring the integrity of the evidence.
Which THREE actions should be avoided during the initial response phase to ensure evidence integrity?
Patches change the state of the system, potentially destroying evidence.
Why this answer
Modifying, destroying, or altering evidence is strictly forbidden during incident response.
Which documentation is required when transferring physical evidence from a responder to a forensic lab?
A CoC form documents who handled the evidence, when, and where.
Why this answer
Chain of Custody (CoC) documents are required to ensure the legal integrity of the evidence.
In the context of the NIST Incident Response Life Cycle, which phase immediately follows the 'Detection and Analysis' phase, specifically focusing on limiting the scope of the compromise?
Containment is the explicit phase meant to limit the incident scope.
Why this answer
Containment is the phase where the responder takes action to stop the spread or further damage of the incident.
A first responder is using a 'Live Response' toolkit. What is the main characteristic of these tools?
Using an external drive prevents the tool from overwriting data on the target hard drive.
Why this answer
Live response tools are designed to collect data from a running system with minimal impact on the target environment.
While investigating a breach, you need to verify the integrity of a system file. Which process is correct to ensure the file has not been altered?
Cryptographic hashing is the definitive method for integrity checking.
Why this answer
Generating a cryptographic hash (SHA-256) of the file and comparing it to a known good baseline is the standard process for integrity verification.
When notifying stakeholders during a major data breach, which TWO of the following groups must be informed according to standard incident communication plans to satisfy regulatory and operational needs?
They must determine the legal obligations for reporting breaches.
Why this answer
Stakeholder notification must balance legal requirements with operational continuity.
A stakeholder asks you to prioritize the recovery of a compromised system. According to incident response best practices, what is your first responsibility?
Confirmation and triage are the initial steps of the incident response process.
Why this answer
Triage and identification must occur before any recovery or containment steps to ensure the scope is understood.
Which TWO actions are recommended for secure evidence storage?
Ensures physical security and chain of custody.
Why this answer
Evidence should be kept in a controlled, access-restricted environment to maintain its integrity.
Ready to test yourself?
Try a timed practice session using only First Response questions.