A security analyst receives an alert concerning an iOS device belonging to the CFO. The device pings a high-risk country daily because this executive visited that country. Which step must the…

Question

Options

• ARemotely dump the memory of the device, and analyze it for persistency.
• BWipe the device remotely to prevent further compromise of company data.
• CTell the CFO to put the device in a Faraday bag and ship it to the headquarters.
• DInvestigate the device network logs, and analyze the data being sent.

• A
  4% (2)
• B
  7% (4)
• C
  76% (41)
• D
  13% (7)

Explanation

Placing the device in a Faraday bag is the correct first step because it immediately isolates the device from all wireless signals (cellular, Wi-Fi, Bluetooth), cutting off any active connection a threat actor might have - preserving the device's current state as forensic evidence without destroying data or tipping off an attacker.

Why the distractors fail:

• A (Remote memory dump): Remotely accessing the device while it's potentially compromised and still connected introduces risk - the threat actor could detect the action or the connection itself could be exploited; also, remote memory dumping iOS devices isn't straightforward.
• B (Remote wipe): Wiping destroys forensic evidence, making it impossible to determine how the device was compromised or what data was exfiltrated - this eliminates the threat but also eliminates the investigation.
• D (Investigate network logs): Log analysis is a valid later step, but it doesn't stop an active threat actor who may still have live access to the device right now.

Memory tip: Think "isolate before you investigate." The Faraday bag is the mobile equivalent of physically unplugging a compromised server - it stops the bleeding and preserves evidence simultaneously. On exams, when a device may be actively compromised, physical isolation always comes before remote actions or analysis.

No community discussion yet for this question.