Free Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Conducting Forensic Analysis and Incident Response Using Cisco Technologies for Cybersecurity practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1An incident report must let reviewers reconstruct how the intrusion unfolded. Which report component directly serves that purpose?

   1. A. Current risks remaining after response
   2. B. The chain of events during the incident
   3. C. Decisions to follow after the report
   4. D. Technical inspection results from devices

   Answer: B

   Explanation: NIST lists "The chain of events" among report content. That chronology lets reviewers reconstruct the sequence of the intrusion; the other choices document different aspects of the same incident.

   Reference: NISTIR 8428: Digital Forensics and Incident Response (DFIR) Framework for Operational Technology (OT) — Section 4.2.5, E.4 Final Report completion, p. 49

2. 2Malicious code runs from a Windows Registry value rather than a conventional executable file. Which ATT&CK storage mechanism should the analyst investigate?

   1. A. Fileless storage in the Registry
   2. B. Timestomping of a file
   3. C. Deletion of an executable
   4. D. Network share connection removal

   Answer: A

   Explanation: MITRE lists "the Windows Registry, event logs, or WMI repository" as nonvolatile fileless storage. A Registry value can hold staged malicious content even when no ordinary executable is present.

   Reference: MITRE ATT&CK: Obfuscated Files or Information: Fileless Storage — T1027.011, Description

3. 3A Cisco syslog entry carries severity number 4. How should an analyst classify its severity?

   1. A. Critical
   2. B. Warning
   3. C. Informational
   4. D. Debugging

   Answer: B

   Explanation: Cisco's severity table pairs "Warning" with "4". The other levels have different numbers, so the entry is a warning.

   Reference: Cisco: Identifying Incidents Using Firewall and Cisco IOS Router Syslog Events — Log Messages of Interest, severity table

4. 4Network evidence shows an intruder routed command traffic through several proxy systems before it reached a victim. What forensic inference becomes less reliable from the final connection's IP alone?

   1. A. The intruder's original network source or location
   2. B. The victim service's destination port number
   3. C. The time the victim accepted the connection
   4. D. The traffic volume observed at the victim

   Answer: A

   Explanation: MITRE says, "Adversaries may chain together multiple proxies to further disguise the source of malicious traffic." The last proxy's address therefore does not reliably identify the actor's origin or geographic location; the victim's own observed connection attributes remain observable.

   Reference: MITRE ATT&CK: Proxy — T1090, Description

5. 5What risk-reduction goal does a prompt, systematic incident response serve when an intrusion threatens business data and services?

   1. A. Minimize data loss and service disruption
   2. B. Determine the intrusion's initial entry point
   3. C. Preserve evidence for later forensic analysis
   4. D. Restore affected systems from clean backups

   Answer: A

   Explanation: NIST says effective response reduces risk by "minimizing data loss or theft, the disruption of services, and the overall impact of incidents." It does not guarantee zero future incidents or remove the need for prevention.

   Reference: NIST SP 800-61r3: Incident Response Recommendations and Considerations for Cyber Risk Management — Introduction, p. 2

6. 6During initial forensic triage of a suspected Cisco IOS device, why should the analyst avoid rebooting it?

   1. A. A reboot clears volatile state that may be evidence.
   2. B. A reboot changes the published IOS image hash.
   3. C. A reboot disables all subsequent CLI collection.
   4. D. A reboot prevents later access to stored syslogs.

   Answer: A

   Explanation: Cisco warns that "Rebooting a device during an initial assessment will irrecoverably lose all volatile information contained within the device". RAM, tables, and counters may be lost before collection.

   Reference: Cisco IOS Software Forensic Data Collection Procedures — Introduction, IMPORTANT

7. 7A suspicious process contains code that did not originate from its normal image, and the code runs in that live process's address space. Which method best fits the observation?

   1. A. Software packing
   2. B. Process injection
   3. C. File timestomping
   4. D. Event log clearing

   Answer: B

   Explanation: MITRE defines process injection as "executing arbitrary code in the address space of a separate live process." The runtime placement of code in another process is the defining observation.

   Reference: MITRE ATT&CK: Process Injection — T1055, Description

8. 8An ASA log line begins `%ASA-4-106023: Deny tcp` and names source and destination addresses. What happened to the attempted connection?

   1. A. The firewall denied it by an access group.
   2. B. The firewall built an inbound TCP connection.
   3. C. An IPS signature was merely observed.
   4. D. The router exported a NetFlow record.

   Answer: A

   Explanation: Cisco's example shows "%ASA-4-106023: Deny tcp" followed by "by access-group". That message reports a deny decision for the stated flow, not a built connection.

   Reference: Cisco: Identifying Incidents Using Firewall and Cisco IOS Router Syslog Events — Log Messages of Interest, ASA 106023

9. 9A threat actor overwrites a targeted file with random bytes before removing it. Compared with merely deleting a directory entry, what additional forensic obstacle does the overwrite create?

   1. A. The original file contents may be irrecoverable
   2. B. The original bytes remain recoverable from the deleted directory entry
   3. C. The original file hash can reconstruct the overwritten contents
   4. D. The deleted filename can verify the original contents

   Answer: A

   Explanation: MITRE states that "Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives." Ordinary deletion may leave recoverable content; overwriting attacks the bytes needed for recovery.

   Reference: MITRE ATT&CK: Data Destruction — T1485, Description

10. 10An active intrusion is spreading to additional hosts. Which immediate incident-response goal does containment address?

    1. A. Prevent expansion of the incident
    2. B. Restore affected systems to normal service
    3. C. Document the final incident chronology
    4. D. Eliminate persistence from affected hosts

    Answer: A

    Explanation: NIST states, "Containment refers to preventing the expansion of an incident." Restoration and eradication address later or different goals, and reporting does not itself stop spread.

    Reference: NIST SP 800-61r3: Incident Response Recommendations and Considerations for Cyber Risk Management — Table 3, RS.MI-01, p. 32