712-50 · Question #244
SCENARIO: Critical servers show signs of erratic behavior within your organization's intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief…
The correct answer is D. Preservation of information. Preservation of information (D) is the most critical activity because when criminal activity is suspected, evidence integrity determines whether prosecution is possible. Destroying, altering, or failing to properly preserve forensic evidence - even unintentionally during…
Question
SCENARIO: Critical servers show signs of erratic behavior within your organization's intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team. During initial investigation, the team suspects criminal activity but cannot initially prove or disprove illegal actions. What is the MOST critical aspect of the team's activities?
Options
- ARegular communication of incident status to executives
- BEradication of malware and system restoration
- CDetermination of the attack source
- DPreservation of information
How the community answered
(19 responses)- A5% (1)
- B16% (3)
- C5% (1)
- D74% (14)
Explanation
Preservation of information (D) is the most critical activity because when criminal activity is suspected, evidence integrity determines whether prosecution is possible. Destroying, altering, or failing to properly preserve forensic evidence - even unintentionally during cleanup - can render it inadmissible and eliminate legal recourse entirely. This is a foundational principle of incident response: contain and preserve before you remediate.
Why the distractors fall short:
- (A) Executive communication is important operationally, but it's a secondary concern and does not affect the legal outcome of the incident.
- (B) Eradication and restoration is actually dangerous to perform prematurely when criminal activity is suspected - wiping systems destroys evidence.
- (C) Attribution (attack source) is valuable but cannot be established without properly preserved evidence in the first place; it's a downstream goal, not the immediate priority.
Memory tip: Think of the IRT as a crime scene investigator, not a janitor. Police secure and photograph the scene before cleaning it up. When "criminal activity" appears in the question, immediately think evidence preservation - legal considerations override operational speed.
Topics
Community Discussion
No community discussion yet for this question.