1. During a recent data breach at your organization, a forensic expert was brought in to ensure that the evidence was retained in a proper manner. The forensic expert stressed the need to ensure the chain of custody. Which of the following components is not part of the chain of custody?
A) who secured the evidence B) who detected the evidence C) who obtained the evidence D) who controlled the evidence
2. Your organization just deployed an enterprise instant messaging solution. The CIO is concerned about the transfer of worms, Trojans, and other malware through the IM connections. Which of the following would not be a measure that could help mitigate the introduction of malware through the IM system?
A) Purchase a product that performs encryption. B) Install an anti-malware product that can plug into the IMclient. C) Train users in the dangers of using IM. D) Disable the ability to transfer files through the system.
3. Your organization does not have an e-discovery process in place. Management has asked you to provide an explanation for why ediscovery is so important. What is the primary reason for this process?
A) to provide evidence B) to provide access control C) to provide intrusion detection D) to provide intrusion prevention
4. You are working with a project team to deploy several new firewalls. The initiation stage is complete, and now the team isengaged in the acquisition stage. Which step should the team complete as part of this stage?
A) Design the security architecture. B) Test the routers for security resiliency. C) Update the routers with the latest updates from the vendor. D) Provide security categories for the new routers.
5. Which of the following entails determining the devices in the network, their connectivity relationships to one another, and theinternal IP addressing scheme in use?
A) topology discovery B) service discovery C) OS fingerprinting D) packet capture
1. Right Answer: B Explanation: The chain of custody is not concerned with who detected the evidence. The chain of custody shows who controlled the evidence, who secured the evidence, and who obtained the evidence.
2. Right Answer: A Explanation: Although encryption would help prevent data leakage, it would do nothing to stop the introduction of malware through the IM connection.
3. Right Answer: A Explanation: The primary reason for having an e-discovery process is to provide evidence in a digital investigation.
4. Right Answer: A Explanation: During the acquisition stage, you should design the security architecture.
5. Right Answer: A Explanation: Topology discovery is the process of identifying the devices and their connectivity relationship with one another. It entails attempting to create a map of the network.
Leave a comment