Incident Response

Which of the following best describes the primary purpose of maintaining a chain of custody?

To preserve the integrity of evidence for potential legal proceedings

Which items must always be included when documenting a chain of custody?

Chronological log of everyone who handled the evidence

Date and time of evidence transfer

A technician discovers evidence of credit card data theft on a company server. What is the most appropriate next step?

Notify management and follow escalation procedures

Which of the terms listed below is used to describe a forensic copy of a storage device that captures every sector of the drive, including deleted files, hidden partitions, and unallocated space?

Bit-by-bit image

During an incident investigation, a technician must acquire data from a suspect’s storage drive without altering any information. Which of the following ensures the contents of the drive cannot be modified during this process?

Write blocker

A technician needs to confirm that a forensic image has not been altered since its creation. Which method provides this assurance?

Comparing hash values

When documenting a security incident, which type of detail should be strictly avoided to maintain the integrity of the report?

Speculative statements

Which of the answers listed below shows the basic order of volatility for a typical system?

CPU registers/cache, RAM, Disk, Archival media