Drake is an incident handler in Dark CLoud Inc. He is intended to perform log analysis
in order to detect traces of malicious activities within the network infrastructure.
Which of the following tools Drake must employ in order to view logs in real time and
identify malware propagation within the network?
A regional healthcare provider leveraging a platform-as-a-service (PaaS) cloud model detects suspicious activity involving unauthorized access to patient records. During the investigation, the incident response team attempts to retrieve system logs from virtual machines used during the breach. However, they realize that crucial log files are unavailable, as the short-lived instances were automatically terminated shortly after the event. This hampers their ability to reconstruct a complete activity trail and trace the attacker ' s movements. Which core cloud forensic challenge does this situation most likely reflect?
A cybersecurity team at a financial services firm detects abnormal behavior on several endpoints, suggesting a possible breach. The anomalies include unexpected data transfers and processes running with unusual permissions. Given the potential impact, the team needs to quickly validate whether these are indicators of a security incident or benign anomalies. What method should the team prioritize to detect and validate the incident effectively?
After experiencing a web application attack, HealthFirst, a health records management company, traced the breach to an insecure Direct Object Reference (IDOR) vulnerability. They seek to patch this vulnerability and fortify their application against future incidents. What should be their primary action?
Francis received a spoof email asking for his bank information. He decided to use a tool to analyze the email headers. Which of the following should he use?
Rachel, a first responder, finds a smartphone in an executive’s office that is powered ON and actively displaying a messaging app with potentially incriminating information. She avoids locking the screen or turning off the device, photographs the current display, and collects its charging cable. She then safely packages the device and ensures it is kept charged during transport. What principle is Rachel applying in her evidence handling approach?
Francis is an incident handler and security expert. He works at MorisonTech Solutions based in Sydney, Australia. He was assigned a task to detect phishing/spam mails for the client organization.
Which of the following tools can assist Francis to perform the required task?
Liam, a senior incident responder at a manufacturing company, is alerted to an email campaign distributing malware through fake invoice attachments. He confirms that some users opened the attachment, resulting in system slowdown and unauthorized access attempts. He disconnects affected machines, scans and removes malware, disables compromised accounts, restores systems from clean backups, and documents file hashes, sender IPs, and malicious domains. Which of the following best describes Liam’s objective?
An attacker after performing an attack decided to wipe evidences using artifact wiping techniques to evade forensic investigation. He applied magnetic field to the digital
media device, resulting in an entirely clean device of any previously stored data.
Identify the artifact wiping technique used by the attacker.
After experiencing a large-scale distributed denial-of-service (DDoS) attack that caused service outages and degraded performance to its online subscriber portal, a national telecom provider was able to recover and restore its web platform. With customer trust on the line and concerns about similar future incidents, the organization ' s IH & R team has been tasked with implementing robust post-recovery measures that enhance the resilience of web services against traffic-based disruptions. The team is evaluating several options to maintain service availability while mitigating the potential impact of recurring DDoS attempts. Which of the following actions would be most effective in strengthening the provider ' s defenses as part of the recovery process?
