CCNA First Response Questions

The -a switch lists all connections and listening ports, -n prevents DNS resolution so results are immediate and unaltered, -o shows the owning process ID, and -b displays the executable name. Running this before network isolation preserves ephemeral connections tied to malicious processes that would otherwise be lost or reset.

Documenting the physical state and initiating chain of custody before any interaction preserves the evidentiary value of the device. Photographs and written records establish that the laptop was received in a known condition, and the custody log creates an auditable trail that supports admissibility if the case proceeds to legal action.

The incident response team must be activated first because it owns containment, eradication and recovery. Notifying executives, legal or communications before the responders delays technical action, allowing the incident to spread while no one is yet investigating or containing it.

NTP drift skews local file system timestamps, so recording the offset lets investigators correct them before correlating against firewall, IDS and server logs. Without this, the timeline of intrusion events becomes unreliable, undermining attribution and scope determination during the first-response triage.

Hardware acquisition tools interface directly with the memory bus or use DMA to read RAM without executing code on the host, preserving the integrity of volatile data. This minimizes changes to the system state while capturing the exact contents needed for analysis. It is the preferred method when live memory capture is required and the system must remain powered on.

WinPmem and comparable tools are specifically designed to acquire a forensic image of physical memory while minimizing changes to the system. They produce a raw memory dump that can be analyzed for running processes, network connections, and injected code. This directly satisfies the requirement to capture volatile memory before shutdown, preserving evidence that would otherwise be lost.

System memory (RAM) is volatile because its contents are lost when power is removed, satisfying the stem's requirement for evidence that degrades quickly. RAM holds running processes, encryption keys and network connections that vanish on shutdown, so it must be captured first, before disk imaging, to preserve forensic artefacts.

A snapshot with memory captures the VM's volatile state, including running processes and RAM contents, alongside disk. This preserves forensic evidence that a disk-only snapshot or live login would alter, satisfying the requirement to capture the VM's state before any analysis begins.

Capturing the live screen state preserves volatile visual evidence such as open windows, command prompts, and error messages that may disappear once the system is powered down or the user logs off. This documentation is a critical first step in first response, as it provides context and corroboration for later forensic analysis without altering the system.

RAM holds running processes, open network sockets, encryption keys, and volatile registry hives that vanish when power is removed. In a live USB exfiltration scenario, the responder must capture memory first because it contains the most perishable evidence, such as the process that accessed the USB device and any in-memory malware. This aligns with the order of volatility taught in incident handling.

The First Responder Toolkit contains write-blocked acquisition utilities that capture volatile memory, disk images and logs while preserving evidential integrity. Collecting artefacts without modifying the target system maintains the chain of custody, which is the toolkit's defining purpose during the initial incident response phase.

Creating a forensic image with dd preserves the exact state of the file system, including metadata such as timestamps, permissions, and inodes. Analyzing the image instead of the live system prevents accidental modification of metadata. This is the first step to ensure integrity because it captures a bit-for-bit copy that can be verified with hashes. Subsequent analysis on the image does not alter the original evidence.

Recording a detailed physical description and unique identifiers such as serial numbers ties the evidence to the specific device, preventing substitution or ambiguity later. This supports the CoC requirement that every item be uniquely traceable throughout its custody.

Get-NetTCPConnection is a PowerShell cmdlet that lists active TCP connections and their states. It provides similar information to netstat but in a structured, object-oriented format that can be easily exported or filtered. It is a legitimate tool for capturing volatile network connection data on Windows systems, especially in modern environments where PowerShell is available.

A bootable forensic collection drive lets the responder boot the suspect machine into a trusted environment, capturing volatile memory and disk images without altering the installed operating system. This satisfies the stem's physical toolkit requirement by enabling evidence preservation at the scene before any shutdown or tampering occurs.

The `ss -tupn` command reads live socket tables directly from the kernel, listing TCP and UDP connections with numeric ports and owning processes. Unlike `netstat`, it does not write to disk or modify connection state, satisfying the requirement to capture current network connections without altering evidence.

LiME (Linux Memory Extractor) is a loadable kernel module designed for forensically sound memory acquisition on Linux. It captures physical memory to a file or over the network, minimizing the footprint on the target system. It handles large memory sizes and produces an image that can be analyzed with tools like Volatility. Loading a kernel module is a controlled action that does not require rebooting and preserves the system's running state. This is the preferred method for live Linux memory acquisition.

The Windows Management Instrumentation Command-line (WMIC) utility can retrieve detailed process information, including full command-line arguments, using a simple query. This is a native tool available on most Windows systems and provides a comprehensive, scriptable way to capture process data without installing third-party software, making it ideal for first response.

Web server access logs record each HTTP request with source IP, timestamp, URL and query string, so the injected SQL payload and originating address are captured there, unlike application or database logs that may omit the client's network origin.

Connecting the device lets the workstation mount it as a writable volume, so the operating system or sync services can update timestamps, journal entries and file metadata. That violates the forensic requirement to preserve the original evidence unaltered, which a hardware write blocker prevents by enforcing read-only access at the block level.

The -a switch shows all active connections and listening ports, -n displays addresses and port numbers numerically (avoiding DNS lookups that could alter evidence), and -o includes the owning process ID (PID). This directly provides the mapping between network connections and processes, which is critical for identifying the RAT process. It is a built-in Windows command that does not require additional tools and minimally alters the system state.

The MBR and EFI system partition hold boot code executed before the OS loads, so a rootkit placed there gains persistent pre-OS execution and evades file-system scanning. Registry Run keys and services load later, making them less suitable for boot-time persistence.

Accurate time synchronisation, typically via NTP, ensures timestamps from firewalls, servers and endpoints align on a common clock. Without it, correlating events across disparate log sources during incident documentation becomes unreliable, since drift obscures the true sequence of activity.

Minimal system impact preserves volatile evidence such as memory-resident artefacts and running processes, which forensic toolkits must capture before they are altered. This criterion directly satisfies the stem's requirement that a first responder choose tools that avoid disturbing the target system during live acquisition, keeping collected data forensically sound and admissible.

Legal and compliance teams must be notified because they own statutory breach-reporting duties, assessing jurisdiction-specific deadlines and regulator obligations. They interpret contractual notification clauses and privacy legislation, determining what the organisation must disclose and when. This satisfies the stem's requirement to identify stakeholders whose remit directly governs breach notification decisions.

Preserving encrypted samples and volatile memory captures the encryption artefacts and any residual keys or processes before remediation alters them. This satisfies the forensic requirement to secure evidence first, since recovery attempts overwrite memory and destroy indicators needed to identify the ransomware strain and decryption viability.

The netstat -ano command displays all active TCP and UDP connections, listening ports, and the owning process ID (PID) for each connection. This is exactly what the responder needs to correlate network activity with running processes. The -a shows all connections, -n displays addresses numerically, and -o gives the PID. This output is volatile and should be saved to external media for later analysis. It is a standard first response command on Windows systems.

A hard disk drive retains its stored data when power is removed, unlike RAM or cache, which lose contents on shutdown. This persistence satisfies the question's requirement for a non-volatile source, making it the appropriate example of storage that survives power loss.

Security Groups act as stateful virtual firewalls at the instance's elastic network interface, so restricting all inbound and outbound rules immediately severs the EC2 instance's traffic without terminating it — satisfying the containment requirement while preserving forensic state.

netstat -ano lists active connections with their owning process ID, letting you correlate the foreign IP connection to the exact process. This maps network activity to a PID, which you then resolve to an executable, directly identifying the initiating process.

Legally defensible chain of custody requires each transfer to record who released the evidence, who received it, the exact date and time, and where it was stored. These four elements let a court trace unbroken possession from seizure to presentation.

The arp -a command displays the local ARP cache, listing IP-to-MAC mappings for recently contacted hosts. Inspecting these entries reveals duplicate or conflicting MAC addresses indicative of ARP spoofing on the local segment, satisfying the responder's need.

Rootkits often replace or trojanise system binaries, so hashing critical executables and comparing against a trusted baseline reveals tampering. This satisfies the need to gather evidence of intercepted system calls without altering the compromised host.

Using a statically linked toolkit on read-only media ensures the tools you execute are not the potentially trojanized system binaries. Comparing outputs reveals discrepancies that indicate userland rootkit tampering, while the read-only medium guarantees your collection tools cannot be altered by the compromised host during the response.

PowerShell and similar built-in administrative tools write to event logs, prefetch, and command history, altering the target system's state and overwriting volatile evidence. This satisfies the stem's remote-agent constraint by showing that such tools compromise forensic integrity through unavoidable artefacts on the machine being examined.

LiME is a loadable kernel module designed for volatile memory acquisition on Linux. It allows capturing memory to a file or over the network without requiring a system reboot, minimizing disruption to running services. It is a widely accepted tool in incident response for live memory forensics, ensuring evidence integrity and minimal impact.

Resetting the password and revoking active sessions immediately terminates the attacker's authenticated access, satisfying the containment requirement. Password reset alone leaves stolen tokens valid, so session invalidation is essential to stop ongoing exfiltration through the compromised account.

Network connections are highly volatile and can disappear quickly, especially if an attacker closes a backdoor or the connection times out. The netstat -antp command shows active TCP connections, listening ports, and associated processes, which is critical for identifying command-and-control channels. Capturing this before other data aligns with the order of volatility, as network state is more ephemeral than process lists or disk information.

RAM is the most volatile evidence and contains running processes, network connections, and potentially encryption keys. Capturing it first preserves data that would be lost on shutdown or reboot. The responder should use a trusted memory acquisition tool from external media to avoid contamination. This aligns with the order of volatility and ensures that critical evidence is not destroyed by subsequent actions. Memory capture is a foundational step in first response for live systems.

Cryptographic hashes produce a fixed-length digest of each collected file. Recomputing and comparing hashes later proves the evidence has not been altered, satisfying the stem's evidence-preservation requirement by establishing verifiable integrity for the digital incident investigation.

The netstat -ano command displays all active connections and listening ports, with the -o switch showing the owning process ID and -a showing all connections. This is a native Windows utility that requires no third-party installation, making it ideal for first response when tool deployment is restricted. It provides critical mapping between network activity and processes.

Recording the date and time of incident discovery establishes the authoritative timeline anchor for the triage report. It supports containment decisions, regulatory notification deadlines and later forensic reconstruction, giving responders a precise reference point for measuring detection and response intervals.

A write blocker intercepts write commands at the hardware interface, allowing the examiner to read the drive while physically preventing any modification. This preserves the source media's integrity, satisfying the forensic requirement that evidence remain unaltered and admissible.

A Chain of Custody form records each transfer, handler, date and purpose, preserving evidence integrity and admissibility. It satisfies the scenario's requirement to document the handover from responder to forensic lab, ensuring an unbroken, auditable trail that courts accept.

Containment immediately follows Detection and Analysis in the NIST Incident Response Life Cycle, focusing on limiting the scope and impact of the compromise before eradication and recovery begin. It directly addresses the stem's requirement to limit the compromise's spread.

Live Response toolkits execute from external media such as a USB drive, keeping binaries and writes off the target's internal disk. This preserves volatile evidence and disk integrity, satisfying the first responder's need to investigate a running system with minimal alteration before full forensic imaging.

A SHA-256 hash produces a fixed-length digest of the file's contents; any alteration changes the digest entirely. Comparing the computed value against a trusted baseline proves integrity, unlike timestamps or file size, which an attacker can preserve.

Photographing the screen and peripherals documents the current state of the system without altering it. This is a non-intrusive way to capture volatile evidence such as open applications, error messages, and network activity. It is a fundamental first step in first response, ensuring that visual context is preserved before any further actions that might change the system state.

Legal Counsel or the Privacy Officer must be informed to assess notification duties under data protection law, manage regulator and affected-party communication, and limit liability. This satisfies the regulatory element of the stem's incident communication requirements.

Before containment, eradication or recovery, the responder must verify that an incident actually occurred, distinguishing genuine compromise from false positives. Confirming the incident satisfies the stem's requirement to prioritise recovery only after validation, per incident response best practice.

In a production environment where downtime is unacceptable, the memory acquisition tool must be stable and not cause a system crash. A crash would not only disrupt services but also destroy the volatile evidence. Tools that operate in kernel mode or use specialized drivers must be thoroughly tested to ensure they do not conflict with existing software. This factor is paramount to balance forensic needs with operational continuity.

The arp -a command displays the current ARP cache, listing IP addresses and their corresponding physical (MAC) addresses. This is essential for identifying potential ARP spoofing or mapping network segments during an incident. On a compromised Windows server, capturing the ARP cache before reboot preserves evidence of local network relationships and possible attacker presence. It directly answers the requirement.

The netstat -antp command displays all TCP connections with numeric addresses, listening ports, and the associated process IDs. On a live Linux system, this captures the current network state, including established connections that may indicate command-and-control or exfiltration channels. The -p flag requires root privileges but provides the critical mapping to the responsible process. This output is volatile and must be saved to external media immediately, as it will change as connections open and close.

RAM is the most volatile evidence and contains running processes, network connections, encryption keys, and injected code that vanish when power is lost. Capturing memory first preserves this ephemeral data before any other action alters it. The supervisor's instruction aligns with the order of volatility, which prioritizes CPU registers and cache, then RAM, before less volatile storage. A memory image also enables later timeline and malware analysis.

A locked cabinet with access control physically restricts who can reach the evidence, preventing tampering or theft. This satisfies the chain-of-custody and integrity requirements for secure evidence storage by limiting access to authorised personnel only.

Capturing a memory image is the highest priority because RAM contents are lost upon power-off or reboot. This step preserves running processes, encryption keys, and network connections that are critical for understanding the incident. It should be done before any other collection to avoid losing volatile data. Using a validated tool ensures the image is forensically sound and can be analyzed later.