Topic: CS0-003 topic 1 question 132

A security analyst discovers an ongoing ransomware attack while investigating a phishing email. The analyst downloads a copy of the file from the email and isolates the affected workstation from the network. Which of the following activities should the analyst perform next?

A.
Wipe the computer and reinstall software
B.
Shut down the email server and quarantine it from the network
C.
Acquire a bit-level image of the affected workstation
D.
Search for other mail users who have received the same file

Re: CS0-003 topic 1 question 132

issue is ongoing, making sure it doesnt spread more is the priority over making a copy

Re: CS0-003 topic 1 question 132

creating a bit level image called forensic image captures the entire content of the hard drive at that point in time.

Re: CS0-003 topic 1 question 132

This information is directly from CertMaster Topic 8B:
Incident responders must make quick decisions regarding the most effective containment technique when a system is compromised. The course of action depends on several factors:

Ensure the safety and security of all personnel. The first concern of all managers involved with the security response is the safety and security of personnel.
Prevent further damage. This will be the overriding priority after the identification of the compromise.
Identify whether the intrusion is a primary or a secondary attack (part of a more complex campaign).
Avoid alerting the attacker that they have been discovered.
Preserve forensic evidence of the intrusion. While waiting for the forensics analyst to arrive, treat the system like any crime scene by preventing anyone from further compromising the system or destroying evidence.

Therefore, D would be the most logical answer if we are using this information because it prevents further damage.

Re: CS0-003 topic 1 question 132

but you are contradicting yourself saying that bud. " Preserve forensic evidence of the intrusion. While waiting for the forensics analyst to arrive " read b4 you type bozzo.

Re: CS0-003 topic 1 question 132

READ BEFORE YOU TYPE... Searching for other mail users who may have been affected would be preventing further damage! Have you took the test? Or passed it? Please fix you inner self because it's very unprofessional to be calling people names based off a difference in opinion. God bless!

Re: CS0-003 topic 1 question 132

Acquiring a bit-level image (also known as a forensic image) of the affected workstation is crucial for a couple of reasons:

Evidence Preservation: It ensures that all the data on the workstation is preserved in its current state, which is essential for any subsequent forensic investigation. This can help in understanding how the ransomware infection occurred, which could be useful in preventing future attacks.

Analysis: With a complete image of the workstation, analysts can perform in-depth analysis without the risk of further contaminating the network or losing critical data.

The other options, while potentially relevant in certain contexts, are not the immediate next steps:

Re: CS0-003 topic 1 question 132

While searching for other mail users who have received the same file (option D) is important for understanding the attack's propagation and identifying potentially affected systems, it may not be the immediate next step after isolating the affected workstation. Acquiring the forensic image takes precedence to ensure that evidence is properly preserved before further actions are taken.

Re: CS0-003 topic 1 question 132

Answer is D. The analyst has already contained the original infected machine.
Next would be to identify the scope of the malware (how many users have been affected).
After the spread has been contained, the analyst can go back and acquire the bit level image for further forensics.
Incident response steps guys.

  • RobV
  • New member
  • Offline

Re: CS0-003 topic 1 question 132

Both Option C and Option D can be part of a comprehensive incident response plan, but if prioritization is necessary, acquiring a bit-level image is often considered an early and essential step in preserving evidence and understanding the immediate impact on the affected system.

Re: CS0-003 topic 1 question 132

Wow this is a good one. I feel like D is the next move because it's just not clear whether the threat has been contained after workstation was isolated. If it is, then people need to be warned first of an ongoing threat so they don't click on any bait. Secure the scene first before starting investigation.

Re: CS0-003 topic 1 question 132

Think in terms of a hospital, whose patient PII has been ransomed. This is now a criminal matter. This device has been ransomwared, this device is now evidence. Ideally someone else on your team is going to alert others to not click on that link or investigate further, but you, with your one task of investigating that device, need to preserve the volatile/ephemeral evidence.

Re: CS0-003 topic 1 question 132

Before you do this "need to preserve the volatile/ephemeral evidence." - you need to consult legal.. thus. legal should be your next step.

So with this question - I believe D is the correct answer.

Re: CS0-003 topic 1 question 132

This is incorrect. You're willing to let the entire database of medical records get compromised just to save a piece of evidence? You want to isolate and prevent the spread of malware. Question states it's ongoing, so you can't just ignore all other workstations.

Re: CS0-003 topic 1 question 132

D) search for other users.

Phishing emails spread like wild fire if not contained. The question states this is ongoing, so it's possible other users can be affected. C is not a viable option, as fixing one workstation is rather pointless if the ransomware spreads to other workstations. Letting the forest burn to save a tree.

Re: CS0-003 topic 1 question 132

Search for other mail users who have received the same file (D): Since the ransomware came through a phishing email, it's crucial to identify other potential victims as quickly as possible to contain the spread of the attack. This would help in taking immediate remedial actions, like isolating affected machines or warning users not to open the malicious file.

Re: CS0-003 topic 1 question 132

The answer is C. Acquire a bit-level image of the affected workstation.

Re: CS0-003 topic 1 question 132

Apologies. After careful analysis of the question, option D is the most logical choice for the proposed scenario.

Re: CS0-003 topic 1 question 132

Answer D
Because, the question specifically states this is an ongoing ransomware attack.

Re: CS0-003 topic 1 question 132

This is the containment stage and not eradication, in containment you would go and prevent further damage to contain the incident, the isolated computer is already hit with ransomware bit level backup won't make a difference at this point, contain first then move to bit level and forensics to eradicate then wipe clean

Re: CS0-003 topic 1 question 132

Correct
Acquiring a bit-level image of the affected workstation is a critical step in the incident response process. This involves creating a forensic copy of the system's entire hard drive or storage media. It allows the analyst to preserve the current state of the system for further analysis and investigation while ensuring that no data is lost or tampered with.