Security Incident Investigation Quiz

What you'll be asked

1. During a security incident, what is the primary purpose of creating a forensic image of a compromised drive before analysis?
2. You notice an unusual spike in outbound traffic from a web server to an unknown IP address. What is the most appropriate first step in the incident response process?
3. Which of the following is considered a 'volatile' data source that should be collected first during an incident investigation?
4. While investigating a compromise, you find an entry in the web server access logs showing a 'POST' request to a hidden PHP script with base64 encoded parameters. What does this suggest?
5. You are performing a post-mortem analysis on a Linux server. The attacker used 'timestomping' to hide their activity. Which forensic technique is most effective at identifying this manipulation?

Answers and explanations come after you submit.