Smith employs various malware detection techniques to thoroughly examine the network and its systems for suspicious and malicious malware files. Among all techniques, which one involves analyzing the memory dumps or binary codes for the traces of malware?

• A. Intrusion analysis
• B. Static analysis
• C. Dynamic analysis
• D. Live system

An IT security analyst at a logistics firm is alerted to unusual outbound traffic originating from an employee ' s mobile device, which is actively connected to the corporate VPN. Initial investigation confirms the presence of malware. Although antivirus scans are run multiple times, the malicious activity continues, suggesting the infection is deeply embedded or resistant to standard removal methods. The organization cannot afford further data leakage or operational disruptions caused by this device. Which action should the incident handler take next to ensure complete removal of the persistent threat and restore device integrity?

• A. Restrict background app refresh for social apps.
• B. Disable the SIM card.
• C. Switch the device to airplane mode.
• D. Perform a factory reset or reinstall the mobile OS.

Lena, a SOC analyst, observes a pattern of unusual login attempts originating from multiple foreign IP addresses tied to shared drive links circulating within the organization. These links were embedded in emails appearing to come from the HR department and marked with urgent subject lines. Upon deeper inspection, Lena finds multiple similar messages still pending in the mail server ' s delivery queue. To prevent widespread exposure, she takes immediate action to eliminate these messages before they reach employees ' inboxes. Which incident response action best describes Lena ' s action?

• A. Flagging login anomalies for correlation in the SIEM.
• B. Initiating forensic triage on suspicious attachments.
• C. Isolating compromised mailboxes from the email relay.
• D. Preemptively purging queued phishing emails from the server.

Olivia, a cybersecurity responder at a multinational firm, is alerted late at night by the NOC team about unusual latency and degraded performance across several critical applications hosted on the company's internal servers. Upon initial inspection, she notices that the internal routers are experiencing an unusually high volume of ARP requests being broadcast across the network. The network bandwidth utilization has spiked, and multiple routers are reporting elevated CPU usage.
As she digs deeper into the diagnostics, Olivia finds that the NAT tables on edge routers are saturated with numerous entries coming from the same IP range within a short time frame. These entries appear to be initiating simultaneous connections to different ports across various endpoints. The firewall logs also show repeated attempts to access unused services, and the ISP reports an overflow of incoming requests from various geolocations.
Based on these symptoms, what should Olivia suspect?

• A. Distributed DoS attack
• B. Data exfiltration
• C. Rogue DHCP server activity
• D. Application vulnerability scanning

Liam, a certified digital forensics technician, is dispatched to a corporate office after a suspected insider breach involving unauthorized data exfiltration. Upon arrival, he immediately begins organizing the collection process. He carefully labels each seized device-including laptops, USB drives, and smartphones-with exhibit tags that include his initials, the date and time of seizure, and a unique exhibit number. For each item, he records detailed descriptions in an official evidence logbook, noting the device make, serial number, condition, and where it was found. He also ensures that all items are photographed in their original positions before being moved. As he prepares them for secure packaging and transport, Liam initials each log entry and keeps a running record of who will take charge of the evidence next. Which aspect of evidence handling is Liam demonstrating?

• A. Imaging volatile memory
• B. Creating a chain of custody record
• C. Installing endpoint detection software
• D. Executing malware removal procedures