Marley was asked by his incident handling and response (IH & R) team lead to collect volatile data such as system information and network information present in the
registries, cache, and RAM of victim’s system.
Identify the data acquisition method Marley must employ to collect volatile data.
A social media analytics company uses a cloud-based platform to deploy and manage modular workloads. Following an alert in a background module, the incident response team began log analysis and configuration reviews. While they had access to deployment artifacts and resource usage settings, they lacked visibility into system-level activity, such as task scheduling and component runtime behavior. This information is needed to determine whether the issue originated from the underlying cloud environment. Who holds primary responsibility for providing such access in this cloud model to support the investigation?
Elizabeth, who works for OBC organization as an incident responder, is assessing the risks to the organizational security. As part of the assessment process, she is calculating the probability of a threat source exploiting an existing system vulnerability. Which of the following risk assessment steps is Elizabeth currently in?
Rica works as an incident handler for an international company. As part of her role, she must review the present security policy implemented. Upon inspection, Rica finds that the policy is wide open, and only known dangerous services/attacks or behaviors are blocked. Which of the following is the current policy that Rica identified?
After containing a data compromise that disrupted operations across multiple departments, a global consulting enterprise launched a formal retrospective involving cybersecurity leads, infrastructure managers, legal advisors, and executive stakeholders. The initiative involved constructing a detailed timeline of incident-handling activities, evaluating decision pathways, identifying coordination breakdowns, and recommending actionable improvements to mitigate future occurrences. The review emphasized a no-blame culture, aiming to refine strategic playbooks and organizational readiness based on empirical evidence and shared insights. Which post-incident activity is primarily being executed in this scenario?
DigitalSoft, a major software development firm, recently discovered unauthorized access to its codebase. The culprit was a disgruntled employee who had been overlooked for a promotion. The company wants to prevent such insider threats in the future. What is the most effective measure it can implement?
Alexis is working as an incident responder in XYZ organization. She was asked to identify and attribute the actors behind an attack that took place recently. In order to do so, she is performing threat attribution that deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its target. Which of the following types of threat attributions Alexis performed?
Which of the following terms refers to vulnerable account management functions, including account update, recovery of forgotten or lost passwords, and password reset, that might weaken valid authentication schemes?
Michael, a digital forensic responder, enters a server room after a suspected data breach. He ensures all individuals not involved in the investigation are escorted out, avoids altering any device configurations, and isolates the server from the network without powering it down. What is the main goal of Michael ' s actions?
Malicious Micky has moved from the delivery stage to the exploitation stage of the kill chain. This malware wants to find and report to the command center any useful services on the system. Which of the following recon attacks is the MOST LIKELY to provide this information?
