Due to an incident involving company devices, an incident responder needs to take a mobile phone to the lab for further investigation. Which of the following tools should be used to maintain the integrity of the mobile phone while it is transported? (Select two).

• A.Signal-shielded bag
• B.Tamper-evident seal
• C.Thumb drive
• D.Crime scene tape
• E.Write blocker
• F.Drive duplicator

Comment: *

Name: *

Email: *

Verification: *

An organization needs to bring in data collection and aggregation from various endpoints. Which of the following is the best tool to deploy to help analysts gather this data?

• A.DLP
• B.NAC
• C.EDR
• D.NIDS

Comment: *

Name: *

Email: *

Verification: *

An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

• A.Disable the user's network account and access to web resources
• B.Make a copy of the files as a backup on the server.
• C.Place a legal hold on the device and the user's network share.
• D.Make a forensic image of the device and create a SRA-I hash.

Comment: *

Name: *

Email: *

Verification: *

A cybersecurity analyst is doing triage in a SIEM and notices that the time stamps between the firewall and the host under investigation are off by 43 minutes. Which of the following is the most likely scenario occurring with the time stamps?

• A.The NTP server is not configured on the host.
• B.The cybersecurity analyst is looking at the wrong information.
• C.The firewall is using UTC time.
• D.The host with the logs is offline.

Comment: *

Name: *

Email: *

Verification: *

The Chief Executive Officer (CEO) has notified that a confidential trade secret has been compromised. Which of the following communication plans should the CEO initiate?

• A.Alert department managers to speak privately with affected staff.
• B.Schedule a press release to inform other service provider customers of the compromise.
• C.Disclose to all affected parties in the Chief Operating Officer for discussion and resolution.
• D.Verify legal notification requirements of PII and SPII in the legal and human resource departments.

Comment: *

Name: *

Email: *

Verification: *