CISSP: Certified Information Systems Security Professional

Question

Which evidence-collection technique would be used when an attacker is suspected of using a rootkit and a rapid analysis is required?

Explanation

Live response collects and examines volatile, dynamic evidence from a running system, enabling rapid assessment before rootkit-related artifacts or other transient information can disappear. NIST guidance identifies live-system acquisition as necessary for volatile operating-system data and notes that rootkits can affect the information returned by host commands.

Learn more

NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

CISSP: Certified Information Systems Security Professional

AstroTutor

Notes

Readiness

QuestionQ82

Community Discussion