A city needs automated forensic triage timelines for ransomware hosts using Timesketch/Velociraptor-class tooling. Which approach best fits municipal IR?
Select an answer to reveal the explanation.
Short Explanation
Ransomware clocks are mean—automate triage timelines so the city gets a structured host story fast. You'll stall out if you lean on compliance audit timelines that track controls but don't build attack timelines, integrity assurance that checks tampering but doesn't triage execution, and restoration timelines that promise rebuilds but don't deliver fast review. Forensic tooling automation is how municipal IR keeps pace.
Full Explanation
A city that needs automated forensic triage timelines for ransomware hosts using Timesketch/Velociraptor-class tooling should automate forensic triage timelines with host forensics tooling so ransomware cases get rapid structured review. Ransomware clocks punish delay; scripted collection and timeline assembly give investigators a structured host story—execution, persistence, lateral movement markers—hours instead of weeks later. Municipal IR gains consistent artifacts across endpoints rather than compliance audit timelines with host forensics tooling that track control compliance but cannot reconstruct host execution timelines during rapid triage. Why the other options fail by concept: Automating compliance audit timelines with host forensics tooling tracks policy and audit events but builds no structured host timeline of execution, persistence, and lateral movement needed for rapid ransomware triage. Automating forensic triage timelines with host integrity assurance verifies baseline integrity and tampering but provides no automated timeline assembly of execution, persistence, and lateral movement, leaving investigators without rapid structured review while volatile evidence and attacker dwell artifacts go unanalyzed. Automating forensic triage timelines with host forensics tooling for rapid structured restoration builds the right timeline but aims at the wrong outcome, giving structured review with no rebuild, data recovery, or service restoration that ransomware recovery demands. Exam caveat: automation must respect legal hold, privacy, and change windows on civic hosts; triage speed does not authorize unbounded collection on every endpoint without scope. Operational check: for a ransomware tabletop or pilot host, run the automated triage timeline pipeline, verify hashes and case linkage, and confirm analysts can open a coherent timeline in the municipal forensics console within the target SLA.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.