CAS-002 · Question #882
The DLP solution has been showing some unidentified encrypted data being sent using FTP to a remote server. A vulnerability scan found a collection of Linux servers that are missing OS level…
The correct answer is E. Conduct a bit level image, including RAM, of one or more of the Linux servers. When active exfiltration and unidentified processes are detected, forensic imaging including volatile RAM must be performed first to preserve evidence before any remediation action destroys it.
Question
The DLP solution has been showing some unidentified encrypted data being sent using FTP to a remote server. A vulnerability scan found a collection of Linux servers that are missing OS level patches. Upon further investigation, a technician notices that there are a few unidentified processes running on a number of the servers. What would be a key FIRST step for the data security team to undertake at this point?
Options
- ACapture process ID data and submit to anti-virus vendor for review.
- BReboot the Linux servers, check running processes, and install needed patches.
- CRemove a single Linux server from production and place in quarantine.
- DNotify upper management of a security breach.
- EConduct a bit level image, including RAM, of one or more of the Linux servers.
How the community answered
(43 responses)- A16% (7)
- B2% (1)
- C5% (2)
- D12% (5)
- E65% (28)
Why each option
When active exfiltration and unidentified processes are detected, forensic imaging including volatile RAM must be performed first to preserve evidence before any remediation action destroys it.
Submitting process IDs to an AV vendor is a slow, external action that does not preserve volatile memory evidence, which can be lost before the vendor responds.
Rebooting the servers destroys all volatile memory contents including process tables, network state, and any in-memory malware artifacts critical to the forensic investigation.
Quarantining a server is appropriate but should only occur after imaging, as quarantine alone does not preserve the volatile forensic data needed to understand the attack.
Notifying upper management is necessary but is a communication step, not the first technical action - evidence must be preserved first to support accurate and complete reporting.
A bit-level image that includes RAM captures volatile forensic artifacts - such as running process details, active network connections, and in-memory malware or encryption keys - that are permanently lost upon reboot or shutdown, ensuring the investigation has a complete and legally defensible evidence baseline before any remediation begins.
Concept tested: Digital forensics - volatile evidence preservation and incident response
Source: https://www.nist.gov/publications/guide-integrating-forensic-techniques-incident-response
Topics
Community Discussion
No community discussion yet for this question.