Practice incident forensics vocabulary: evidence preservation, chain of custody, memory dumps, disk images, and timeline reconstruction.
0 / 18 completed
1 / 18
Your incident response plan says 'The forensic investigation preserves evidence.' Why is preservation the first priority?
Digital forensics follows a strict 'preserve first' principle. Running antivirus, rebooting, or modifying files can destroy volatile memory, overwrite logs, or change file timestamps — destroying the evidence needed to understand what happened and how.
2 / 18
A forensics report mentions 'chain of custody for digital evidence.' What does maintaining chain of custody require?
Chain of custody is a documented record showing who collected evidence, when, how it was stored, and who accessed it. Breaks in chain of custody can make evidence inadmissible in legal proceedings and raise questions about whether evidence was tampered with.
3 / 18
An IR analyst says 'The memory dump was captured before the system was rebooted.' Why is this critical?
RAM contains volatile artifacts that are lost on reboot: running malware processes (possibly not on disk), active network connections, decryption keys, and recently run commands. Memory forensics captures these before they are destroyed, often revealing key evidence of attacker activity.
4 / 18
Your forensics procedure requires 'a disk image for offline analysis.' What is a disk image?
A forensic disk image is a sector-by-sector copy of the entire storage device. Analysts work from the image, not the original, to preserve evidence integrity. The image captures deleted files (not yet overwritten), slack space, and filesystem metadata that backups miss.
5 / 18
A forensics team says 'The timeline reconstruction shows attacker movement.' What does timeline reconstruction involve?
Timeline reconstruction combines multiple artifact sources — Windows Event Logs, filesystem timestamps, network logs, browser history, and memory artifacts — to create a chronological record of what the attacker did, when they did it, and how they moved through the environment.
6 / 18
PR Description
Subject: Fix - NullPointerException in Payment Service
Body:
'@john.doe' reported a null pointer exception in the Payment Service after processing a recent transaction. Initial investigation suggests the issue stems from an incomplete data validation step before updating the database. We need to thoroughly examine logs and potentially capture a memory dump for detailed analysis. Requesting assistance with incident forensics – specifically, understanding how to quickly identify the root cause and prevent recurrence.
Which of the following actions would be MOST appropriate for '@jane.smith', the senior developer, to request from the incident response team?
The correct answer emphasizes requesting forensic data – specifically logs and a memory dump. While rolling back might seem tempting, it doesn't address the root cause. A full system audit isn't targeted enough; forensic data provides the granular details needed to pinpoint the precise point of failure. Requesting a memory dump is crucial because it captures the state of the application at the time of the error, offering invaluable clues that logs alone might miss.
7 / 18
@jane.smith reports to @john.doe that the Payment Service outage is potentially due to data corruption. She asks the incident response team to perform a forensic analysis of the server's logs and any related artifacts. Which of the following requests would be MOST helpful for @jane.smith to make, focusing on securing the evidence needed for investigation?
The key here is preserving potential evidence. A full system snapshot (including memory dumps) and network traffic captures are crucial for reconstructing the events leading up to the error – they represent a comprehensive picture of the state of the system at the time of failure. Option A is irrelevant; option C focuses on symptom treatment rather than root cause analysis, and option D would be useful but doesn't address the immediate need to secure potentially corrupted data. Preserving the complete environment allows for detailed examination of the logs and artifacts that might contain clues about what went wrong.
8 / 18
PR Description
Subject: Fix - NullPointerException in Payment Service
Body:
'@john.doe' reported a null pointer exception in the Payment Service after processing a recent transaction. Initial investigation suggests the issue stems from an incomplete data validation step before updating the database. We need to thoroughly examine logs and potentially capture a memory dump for detailed analysis. Requesting assistance with incident forensics – specifically, understanding how to quickly identify the root cause and prevent recurrence.
Which of the following actions would be MOST appropriate for '@jane.smith', the senior developer, to request from the incident response team?
The correct answer emphasizes requesting forensic data – specifically logs and a memory dump. While rolling back might seem tempting, it doesn't address the root cause. A full system audit isn't targeted enough; forensic data provides the granular details needed to pinpoint the precise point of failure. Requesting a memory dump is crucial because it captures the state of the application at the time of the error, offering invaluable clues that logs alone might miss.
9 / 18
@jane.smith reports to @john.doe that the Payment Service outage is potentially due to data corruption. She asks the incident response team to perform a forensic analysis of the server's logs and any related artifacts. Which of the following requests would be MOST helpful for @jane.smith to make, focusing on securing the evidence needed for investigation?
The key here is preserving potential evidence. A full system snapshot (including memory dumps) and network traffic captures are crucial for reconstructing the events leading up to the error – they represent a comprehensive picture of the state of the system at the time of failure. Option A is irrelevant; option C focuses on symptom treatment rather than root cause analysis, and option D would be useful but doesn't address the immediate need to secure potentially corrupted data. Preserving the complete environment allows for detailed examination of the logs and artifacts that might contain clues about what went wrong.
10 / 18
PR Description
Subject: Fix - NullPointerException in Payment Service
Body:
'@john.doe' reported a null pointer exception in the Payment Service after processing a recent transaction. Initial investigation suggests the issue stems from an incomplete data validation step before updating the database. We need to thoroughly examine logs and potentially capture a memory dump for detailed analysis. Requesting assistance with incident forensics – specifically, understanding how to quickly identify the root cause and prevent recurrence.
Which of the following actions would be MOST appropriate for '@jane.smith', the senior developer, to request from the incident response team?
The correct answer emphasizes requesting forensic data – specifically logs and a memory dump. While rolling back might seem tempting, it doesn't address the root cause. A full system audit isn't targeted enough; forensic data provides the granular details needed to pinpoint the precise point of failure. Requesting a memory dump is crucial because it captures the state of the application at the time of the error, offering invaluable clues that logs alone might miss.
11 / 18
@jane.smith reports to @john.doe that the Payment Service outage is potentially due to data corruption. She asks the incident response team to perform a forensic analysis of the server's logs and any related artifacts. Which of the following requests would be MOST helpful for @jane.smith to make, focusing on securing the evidence needed for investigation?
The key here is preserving potential evidence. A full system snapshot (including memory dumps) and network traffic captures are crucial for reconstructing the events leading up to the error – they represent a comprehensive picture of the state of the system at the time of failure. Option A is irrelevant; option C focuses on symptom treatment rather than root cause analysis, and option D would be useful but doesn't address the immediate need to secure potentially corrupted data. Preserving the complete environment allows for detailed examination of the logs and artifacts that might contain clues about what went wrong.
12 / 18
PR Description
Subject: Fix - NullPointerException in Payment Service
Body:
'@john.doe' reported a null pointer exception in the Payment Service after processing a recent transaction. Initial investigation suggests the issue stems from an incomplete data validation step before updating the database. We need to thoroughly examine logs and potentially capture a memory dump for detailed analysis. Requesting assistance with incident forensics – specifically, understanding how to quickly identify the root cause and prevent recurrence.
Which of the following actions would be MOST appropriate for '@jane.smith', the senior developer, to request from the incident response team?
The correct answer emphasizes requesting forensic data – specifically logs and a memory dump. While rolling back might seem tempting, it doesn't address the root cause. A full system audit isn't targeted enough; forensic data provides the granular details needed to pinpoint the precise point of failure. Requesting a memory dump is crucial because it captures the state of the application at the time of the error, offering invaluable clues that logs alone might miss.
13 / 18
@jane.smith reports to @john.doe that the Payment Service outage is potentially due to data corruption. She asks the incident response team to perform a forensic analysis of the server's logs and any related artifacts. Which of the following requests would be MOST helpful for @jane.smith to make, focusing on securing the evidence needed for investigation?
The key here is preserving potential evidence. A full system snapshot (including memory dumps) and network traffic captures are crucial for reconstructing the events leading up to the error – they represent a comprehensive picture of the state of the system at the time of failure. Option A is irrelevant; option C focuses on symptom treatment rather than root cause analysis, and option D would be useful but doesn't address the immediate need to secure potentially corrupted data. Preserving the complete environment allows for detailed examination of the logs and artifacts that might contain clues about what went wrong.
14 / 18
During a Slack conversation about a suspected DDoS attack on the API gateway, @sarah.lee asks the senior engineer, 'What does capturing a packet capture (PCAP) offer that simply reviewing the firewall logs doesn't?'
A packet capture (PCAP) provides a granular view of network traffic that goes beyond what's captured in firewall logs. Firewall logs typically summarize events, while PCAPs record the actual data exchanged between systems, allowing investigators to examine timing patterns, protocols used, and potentially identify anomalous behavior indicative of an attack. This level of detail is vital for reconstructing the attack sequence.
15 / 18
As part of a post-incident review, you're examining a report stating 'The system's rootkit detection software flagged suspicious processes.' What is the MOST likely underlying technical reason for this finding?
Rootkits operate by deeply integrating themselves within an operating system, often modifying system files and processes to conceal their presence. This makes them appear as legitimate system components to standard utilities like process lists or file explorers. This stealthy behavior is the core characteristic of a rootkit, hence the flag from the detection software.
16 / 18
During a standup meeting, the Incident Manager asks: 'What's the purpose of creating a forensic image before running memory analysis?'
Running memory analysis directly on the compromised system can inadvertently alter data, leading to inaccurate results. A forensic image creates a bit-for-bit copy of the system's state before any changes are made, ensuring that the evidence remains unaltered throughout the investigation process. This immutability is absolutely crucial for maintaining chain of custody and reliable findings.
17 / 18
A code review comment reads: 'The application logs are missing timestamps on the error events.' What is the primary reason for this omission being problematic during incident forensics?
Timestamps provide crucial chronological information for reconstructing the sequence of events that led to an error. Without them, investigators cannot accurately determine when and how the error occurred, making it impossible to establish a timeline or correlate related events across different logs. This lack of temporal context significantly degrades the effectiveness of the forensic analysis.
18 / 18
You are reviewing a PR description for a fix to a SQL injection vulnerability. The description includes the phrase 'Analyzing the query execution plan can help identify vulnerabilities.' What does this statement refer to?
When analyzing SQL injection vulnerabilities, understanding *how* the database engine processes a potentially vulnerable query is critical. The query execution plan reveals details about joins, indexes used, and other operations that could be manipulated to inject malicious code. By examining this plan, investigators can identify opportunities for attackers to exploit weaknesses in the database's processing logic.
What does the "Incident Forensics Vocabulary" exercise practise?
Practice incident forensics vocabulary: evidence preservation, chain of custody, memory dumps, disk images, and timeline reconstruction.
How many questions are in this exercise?
This exercise has 18 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Intermediate. If the vocabulary feels difficult, browse the Cybersecurity category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Incident Forensics Vocabulary" part of a larger series?
Yes — it's one exercise in the Cybersecurity category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Cybersecurity category page for related exercises, or browse the main Exercises hub for other IT English topics.