Incident Response and Management

A threat report states an actor typically follows this order: harvest employee names from social media, register a lookalike domain, send a credential-phishing email, then log in to the webmail portal with captured credentials. Leadership asks which single framework BEST describes an adversary's end-to-end progression through these sequential phases so the team can reason about where to break the chain. Which framework should you cite?

• AThe Cyber Kill Chain, because it models an intrusion as ordered sequential phases from reconnaissance to actions on objectivescheck_circle Correct
• BThe Diamond Model, because it orders the four vertices into the stages an intrusion moves through over time
• CThe MITRE ATT&CK matrix, because its tactics columns are a fixed chronological order every intrusion must follow
• DThe OWASP Top Ten, because it ranks the phases of a web intrusion in the order an attacker performs them

Why A is correct: The Kill Chain is explicitly a phased, sequential progression, which matches the request to reason about breaking the chain at an ordered stage.

Why B is wrong: The Diamond Model relates adversary, capability, infrastructure, and victim, but it is not a time-ordered phase sequence, so it does not describe end-to-end progression.

Why C is wrong: ATT&CK tactics are goal categories, not a mandatory chronological path, so treating the matrix as a strict sequence misreads how it is meant to be used.

Why D is wrong: The OWASP Top Ten lists web application risk categories, not a phased adversary progression, so it does not answer the question at all.

During triage you review an EDR alert on a finance workstation: 'rundll32.exe loaded a signed but unusual DLL from C:\Users\Public, then spawned a connection to a known content delivery domain'. Your team maps every observation to MITRE ATT&CK. Which mapping BEST fits the rundll32 behaviour observed here?

• AInitial Access via T1566 Phishing, because the workstation belongs to a finance user who is a common phishing target
• BExfiltration via T1041 Exfiltration Over C2 Channel, because a network connection to an external domain was observed
• CDefense Evasion via T1218 System Binary Proxy Execution, because a trusted signed Windows binary is being abused to run the payloadcheck_circle Correct
• DPersistence via T1547 Boot or Logon Autostart Execution, because the DLL was loaded from a public writable folder

Why A is wrong: Tempting because finance users are phished often, but the evidence shows post-execution binary abuse, not a delivery vector, so mapping to phishing invents a tactic the artefact does not establish.

Why B is wrong: Tempting because an outbound connection is present, but a single connection to a CDN domain is not evidence that data left the host, so keying exfiltration overreads the artefact.

Why C is correct: Correct: rundll32 is a legitimate signed system binary abused to proxy execution of an attacker DLL, which is exactly the living-off-the-land pattern ATT&CK catalogues under T1218.

Why D is wrong: Tempting because a writable path suggests staging, but nothing shows a run key, service, or startup entry, so persistence is a technique the evidence does not support.

During an active ransomware incident, an analyst confirms a finance workstation is encrypting files and beaconing to an external IP. The host holds the only unsynced copy of a spreadsheet the response team still needs. Management wants the malware stopped without destroying that evidence. What is the BEST immediate containment action?

• APower off the workstation immediately to stop the encryption process before more files are lost.
• BRun the endpoint antivirus full scan and remove the ransomware binary from the host.
• CReimage the workstation from a known-good gold image to restore normal operation quickly.
• DIsolate the host at the network layer by moving its switch port to a quarantine VLAN while leaving it powered on.check_circle Correct

Why A is wrong: Killing power feels decisive and does stop encryption, but it discards volatile memory and can corrupt the partially open spreadsheet the team still needs, so it destroys the evidence you were told to protect.

Why B is wrong: Cleaning the binary is eradication, not containment, and it is out of phase; it also modifies the disk before evidence is acquired while the host is still connected and spreading.

Why C is wrong: Reimaging is a recovery step that looks efficient, but it wipes the very disk holding the unsynced spreadsheet and all forensic artefacts, and it does nothing to contain spread from other hosts.

Why D is correct: Network isolation halts the beacon and lateral spread while keeping the system running, which preserves the in-memory state and the unsynced file for later acquisition.

An analyst is acquiring evidence from a compromised Linux server that is still running. To follow the order of volatility, which source should be collected FIRST?

Available sources on the live host:
  - /var/log/auth.log (disk)
  - contents of RAM including running process list
  - a full disk image of /dev/sda
  - archived syslog on an attached backup NAS

• AThe contents of RAM, including the running process list and network connections.check_circle Correct
• BThe /var/log/auth.log file written to the local disk.
• CA full forensic disk image of /dev/sda.
• DThe archived syslog stored on the attached backup NAS.

Why A is correct: Memory is the most volatile source listed; running processes, decrypted keys, and live connections vanish the moment the host is powered down, so order of volatility places it first.

Why B is wrong: Auth logs are valuable, but they sit on non-volatile disk that persists after shutdown, so they are collected after the volatile memory state rather than first.

Why C is wrong: A disk image is essential, but the disk is comparatively stable and survives a reboot, so imaging waits until the volatile memory has been captured.

Why D is wrong: Remote archived logs are the least volatile of the four and change slowly, so they are collected last, not first, under the order of volatility.

An analyst images the disk of a seized laptop and records the following. When the case reaches review, opposing counsel challenges whether the image is unaltered. Which recorded fact BEST supports the integrity of the evidence?

Acquisition notes:
  source SHA-256 : 3f9a...c4e1
  image  SHA-256 : 3f9a...c4e1
  write blocker  : used, model logged
  custody form   : 3 signed transfers, no gaps

• AThe acquisition used a hardware write blocker of a logged model.
• BThe chain-of-custody form shows three signed transfers with no gaps.
• CThe source and image SHA-256 hashes match, and match again on later verification.check_circle Correct
• DThe laptop was stored in a sealed antistatic evidence bag after seizure.

Why A is wrong: A write blocker prevents changes during imaging and is important, but on its own it does not demonstrate that the resulting image still matches the original at review time.

Why B is wrong: An unbroken custody form shows who handled the evidence and is necessary, but it establishes accountability, not that the bits themselves are unaltered.

Why C is correct: Identical cryptographic hashes at acquisition and re-verification prove the image is a bit-for-bit copy that has not changed, which directly answers the challenge of alteration.

Why D is wrong: Proper physical storage protects the device from damage and tampering, yet it provides no mathematical proof that the acquired image content is identical to the source.