Exam SSCP topic 4 question 147 discussion

Actual exam question from ISC's SSCP

Question #: 147
Topic #: 4

When first analyzing an intrusion that has just been detected and confirming that it is a true positive, which of the following actions should be done as a first step if you wish to prosecute the attacker in court?

A. Back up the compromised systems.
B. Identify the attacks used to gain access.
C. Capture and record system information.
D. Isolate the compromised systems.

Show Suggested Answer

Suggested Answer: C 🗳️
When an intrusion has been detected and confirmed, if you wish to prosecute the attacker in court, the following actions should be performed in the following order:
Capture and record system information and evidence that may be lost, modified, or not captured during the execution of a backup procedure. Start with the most volative memory areas first.
Make at least two full backups of the compromised systems, using hardware-write-protectable or write-once media. A first backup may be used to re-install the compromised system for further analysis and the second one should be preserved in a secure location to preserve the chain of custody of evidence.
Isolate the compromised systems.
Search for signs of intrusions on other systems.
Examine logs in order to gather more information and better identify other systems to which the intruder might have gained access.
Search through logs of compromised systems for information that would reveal the kind of attacks used to gain access.
Identify what the intruder did, for example by analyzing various log files, comparing checksums of known, trusted files to those on the compromised machine and by using other intrusion analysis tools.
Regardless of the exact steps being followed, if you wish to prosecute in a court of law it means you MUST capture the evidence as a first step before it could be lost or contaminated. You always start with the most volatile evidence first.
NOTE:
I have received feedback saying that some other steps may be done such as Disconnecting the system from the network or shutting down the system. This is true. However, those are not choices listed within the 4 choices attached to this question, you MUST avoid changing the question. You must stick to the four choices presented and pick which one is the best out of the four presented.
In real life, Forensic is not always black or white. There are many shades of grey. In real life you would have to consult your system policy (if you have one), get your Computer Incident team involved, and talk to your forensic expert and then decide what is the best course of action.
Reference(s) Used for this question:
http://www.newyorkcomputerforensics.com/learn/forensics_process.php and
ALLEN, Julia H., The CERT Guide to System and Network Security Practices, Addison-Wesley, 2001, Chapter 7: Responding to Intrusions (pages 273-277).

by Stevovo123 at Oct. 24, 2023, 7:04 a.m.

Comments

Submit Cancel

Stevovo123

1 year, 1 month ago

Selected Answer: B

When first analyzing an intrusion that has just been detected and confirming that it is a true positive, if you wish to prosecute the attacker in court, one of the first steps should be to identify the attacks that were used to gain access. This involves understanding how the intrusion occurred, the vulnerabilities that were exploited, and the methods employed by the attacker to gain unauthorized access.

upvoted 1 times

swiggharo

10 months, 1 week ago

Wrong. The first thing you should do is to capture and record system information. For example, going to task manager and taking pictures of the running processes.

upvoted 1 times

...

Exam SSCP All Questions

View all questions & answers for the SSCP exam

Exam SSCP topic 4 question 147 discussion

Comments

Stevovo123

swiggharo

Get IT Certification

New Version GCP Professional Cloud Architect Certificate & Helpful Information

The 5 Most In-Demand Project Management Certifications of 2019