In the context of the Order of Volatility during digital evidence collection, which of the following data sources should be captured first to prevent the loss of critical trace evidence?

During the 'Lessons Learned' phase of the Incident Response lifecycle, what is the primary objective of the post-incident activity?

Which of the following describes the 'Magic Number' (or file signature) methodology used by forensic analysts during the file carving process?

An investigator is analyzing a Windows system and needs to find evidence of a specific program's execution history, including the number of times it was run and the last execution timestamp. Which registry hive and key should be prioritized?

When performing an investigation on a live Linux system, an analyst views the /proc directory to gather information. What does the /proc/self/maps file typically provide to the investigator?

In digital forensics, what is the specific purpose of a 'Write Blocker' when imaging a drive for evidence collection?

An investigator discovers a 'Prefetch' file on a Windows 10 workstation during a forensic examination. If the file name is 'CMD.EXE-AC1160D7.pf', what does the hexadecimal string 'AC1160D7' represent?

During a network forensic investigation, an analyst examines a PCAP file and finds a significant amount of traffic on port 53 using the TXT record type. The payload appears to contain base64 encoded strings within the subdomains and records. Which technique is most likely being used by the adversary?

An investigator is analyzing the Windows Event Logs and encounters Event ID 4624 within the Security log. What specific information does this event provide for an Incident Response investigation?

An organization's security operation center (SOC) detects an active ransomware encryption process on a non-critical file server. According to the NIST Incident Response lifecycle, which of the following actions should the incident responder perform first after identifying the threat?

While monitoring internal traffic, a security analyst discovers that a workstation is making multiple unauthorized connection attempts to a database containing sensitive PII (Personally Identifiable Information) using a brute-force method. The analyst has confirmed this is not a false positive. Which step should be taken during the 'Containment' phase to minimize impact while preserving evidence?

During the 'Eradication' phase of a security incident involving a compromised web server, the incident response team identifies several unauthorized 'web shells' and a persistence mechanism in the system's cron jobs. What is the most appropriate action to ensure the threat is completely removed according to industry best practices?

An incident responder is investigating a suspected data exfiltration event. They discover an unauthorized process communicating with an external IP address. Before terminating the process or disconnecting the network cable, the responder decides to capture the contents of the system's RAM. Which of the following best describes the reasoning for this action based on the 'Order of Volatility'?

A high-profile organization experiences a Distributed Denial of Service (DDoS) attack that exhausts its internet bandwidth. After shifting traffic to a cloud-based scrubbers service, the website is back online. In the 'Lessons Learned' phase of the incident response, what should be the primary focus of the team?

An incident response team is handling a breach where an attacker gained access via a vulnerable third-party API. The team has successfully contained the threat. During the 'Recovery' phase, which of the following actions is most critical before returning the affected systems to full production status?

An incident responder identifies that a database administrator's credentials were stolen via a sophisticated phishing attack, leading to unauthorized data access. The responder decides to 'Reset all compromised account passwords' as part of the response. In which phase of the NIST Incident Response lifecycle does this activity primarily occur?

An incident responder identifies that an attacker has gained access to a Linux server by exploiting a misconfigured SSH service. The responder chooses to block the attacker's IP address at the perimeter firewall and disable the SSH service temporarily. Which phase of the incident response lifecycle is being described?

An incident responder is investigating a potential data breach where a large volume of sensitive data was transferred to an external server. The responder needs to determine the exact sequence of events by correlating timestamped logs from the firewall, web proxy, and endpoint devices. To ensure the accuracy of this timeline, which of the following is most critical to have been established during the 'Preparation' phase?

An incident responder is dealing with an insider threat where an employee is suspected of exfiltrating company secrets to a personal cloud storage account. The responder wants to preserve the state of the employee's workstation for potential criminal prosecution. Which of the following should be performed to maintain a 'Chain of Custody'?

An incident responder is using the MITRE ATT&CK Navigator to visualize the coverage of their organization's Security Information and Event Management (SIEM) system. They want to create a heatmap where techniques associated with 'APT28' are highlighted in red, while techniques their SOC can currently detect are highlighted in blue. Which specific Navigator feature should be utilized to merge these two distinct datasets into a single visualization to identify security gaps?

A digital forensics expert is documented the capabilities of a specific malware variant using a MITRE ATT&CK Navigator layer. They want to include specific command-line arguments and file paths discovered during the analysis for several techniques, without cluttering the visualization. Which feature of the Navigator should be used to store this descriptive text so it can be viewed by hovering over or selecting the technique cell?

An AI security researcher discovers that an adversary has gained access to a cloud-based machine learning environment. The attacker is observed modifying the training dataset by injecting carefully crafted data points to cause the model to misclassify specific inputs during future inference. According to the MITRE ATLAS (Adversarial Threat Landscape for Artificial Intelligence Systems) framework, which technique is being utilized if this behavior is mapped alongside MITRE ATT&CK for Enterprise?

An adversary successfully gains access to a researcher's workstation via a Phishing (ATT&CK T1566) campaign. Once inside, they locate the company's proprietary Large Language Model (LLM) weights and download them to a remote server. According to the MITRE ATLAS framework, how would the act of stealing the model weights be classified, and how does it relate to the ATT&CK 'Exfiltration' tactic?

An adversary targets a company's customer service chatbot by utilizing 'Prompt Injection' to force the underlying Large Language Model (LLM) to ignore its system instructions and reveal sensitive API keys stored in its environment variables. According to the MITRE ATLAS framework, which technique is being executed, and which MITRE ATT&CK tactic does this primarily serve when the goal is to obtain credentials for further lateral movement?

Which of the following best describes the primary distinction between the MITRE ATT&CK framework and the MITRE ATLAS framework?