nerdexam
EC-Council

712-50 · Question #257

SCENARIO: Critical servers show signs of erratic behavior within your organization's intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief…

The correct answer is B. Investigation. Investigation (B) is correct because this phase focuses on forensic analysis - the team collects and examines evidence from compromised systems using read-only methods (e.g., memory dumps, disk imaging) specifically to preserve the integrity of original data while determining…

Security Program Management & Operations

Question

SCENARIO: Critical servers show signs of erratic behavior within your organization's intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team. In what phase of the response will the team extract information from the affected systems without altering original data?

Options

  • AResponse
  • BInvestigation
  • CRecovery
  • DFollow-up

How the community answered

(44 responses)
  • A
    5% (2)
  • B
    73% (32)
  • C
    7% (3)
  • D
    16% (7)

Explanation

Investigation (B) is correct because this phase focuses on forensic analysis - the team collects and examines evidence from compromised systems using read-only methods (e.g., memory dumps, disk imaging) specifically to preserve the integrity of original data while determining what happened.

  • Response (A) is wrong because that phase involves taking action to contain or stop the attack, which can alter system state - it's about mitigation, not evidence gathering.
  • Recovery (C) is wrong because recovery happens after the threat is neutralized; it's about restoring systems to normal operation, not extracting forensic data.
  • Follow-up (D) is wrong because this is the post-incident review phase - analyzing lessons learned and improving defenses - not active data collection.

Memory tip: Think "Investigation = no touching the crime scene." Just like detectives photograph evidence before moving anything, investigators extract data without altering it - preservation is the defining characteristic of this phase.

Topics

#Incident Response#Forensic Investigation#Evidence Preservation#IR Phases

Community Discussion

No community discussion yet for this question.

Full 712-50 Practice