Following a high-profile breach investigation at a multinational corporation, an incident handler is tasked with the critical role of preserving, packaging, and transporting digital evidence from a server believed to be compromised and utilized as part of a global botnet operation. The challenge lay not only in the technical complexities of the operation but also in adhering to stringent legal and procedural frameworks to ensure the evidence remained admissible in court. The server, containing potentially millions of records of illicit transactions, represented a key piece of the puzzle in understanding the breadth of the breach. The incident handler had to navigate through multiple layers of security protocols to access the server, all while ensuring that the evidence was handled in a manner that prevented any form of tampering or degradation during the collection, packaging, and transport process. Which of the following options ensures the highest level of evidence integrity during its transport?

• A. Encasing the server in anti-static packaging, labeling it meticulously with the chain-of-custody documentation, and securing it in a locked container for transportation.
• B. Creating a forensic image of the server ' s drives, conducting verification of the image hashes, storing these images on encrypted drives, and completing a detailed log of the transport procedure.
• C. Transferring the server data onto a newly secured drive using a write blocker, placing it within a tamper- evident bag, and employing GPS tracking for the transport process.
• D. On-site encryption of the server ' s data, followed by its upload to a secure cloud storage solution, with the entire process meticulously documented for future verification.

Ethan, part of the IH & R team, receives a phishing email targeting employees with a link to reset passwords.
He hovers over the link and notices a discrepancy between the visible URL and the hyperlink. He cross- verifies the sender's email structure and subject tone to detect further red flags. Which phishing detection approach is Ethan using?

• A. URL shortening detection
• B. Firewall signature matching
• C. Content encoding validation
• D. Manual phishing email verification

A mid-sized healthcare organization undergoing digital modernization is working toward ISO/IEC 27001 certification to enhance patient data safeguards and regulatory compliance. During a readiness review, the CISO identifies significant gaps-staff lack clear channels to raise concerns about potential system weaknesses, outcome tracking after adverse events is inconsistent, and there is no formalized way to assess what went right or wrong following such disruptions. Furthermore, insights from previous security challenges are not being applied to strengthen preparedness or prevent similar future occurrences. To comply with ISO
/IEC 27001 Annex A.16, which action should be prioritized to address these shortcomings?

• A. Conduct tabletop exercises to simulate various insider threat scenarios.
• B. Define and implement structured procedures for flaw escalation and integrating post-incident response knowledge.
• C. Deploy EDR agents across endpoints to block malware propagation and initiate automatic quarantine.
• D. Implement a centralized SIEM dashboard to provide real-time threat correlation and alerting.

Alice is an incident handler and she has been informed by her lead that the data on affected systems must be backed up so that it can be retrieved if it is damaged during the incident response process. She was also told that the system backup can also be used for further investigation of the incident. In which of the following stages of the incident handling and response (IH & R) process does Alice need to do a complete backup of the infected system?

• A. Incident recording
• B. Incident triage
• C. Containment
• D. Eradication