Correct answer:

Obtain a cryptographic hash of the original evidence is correct. Before performing any action on media, you should first obtain a cryptographic hash of the media to establish its authenticity and starting point. This hash can be later compared against any duplicate media to ensure that it was forensically duplicated and that there have been no changes to it.

Incorrect answers:

Perform a direct copy of the evidence to another medium is incorrect. Performing a direct copy of the media to destination media does not ensure authenticity, nor does it typically gather all available evidence from the original media. A forensically sound duplication is preferred over direct copy.

Perform a cursory analysis to ensure the media has potential evidence on it is incorrect. Performing any type of analysis on the original media before it is authenticated or forensically duplicated runs the risk of tainting the evidence on the media and rendering it legally inadmissible in any investigative processes.

Write investigative metadata to the media to show that you have started your investigation is incorrect. Writing any data at all to the original media before it is authenticated or forensically duplicated runs the risk of tainting any evidence on the media and rendering it legally inadmissible in any investigative processes.

Correct answer:

Reputational-based is correct. Reputational-based research provides for collected analysis and signatures for malware from various authoritative sources that have previously seen and catalogued the malware.

Incorrect answers:

Heuristic-based is incorrect. Heuristic-based (also known as behavioral-based) research occurs when there is no signature or reputation available to determine the characteristics of the unknown software or malware, and the malware must be analyzed based upon its patterns or behaviors.

Behavioral-based is incorrect. Behavioral-based research occurs when there is no signature or reputation available to determine the characteristics of the unknown software or malware, and the malware must be analyzed based upon its behaviors.

Anomaly-based is incorrect. Anomaly-based research occurs when there is no signature or reputation available to determine the characteristics of the unknown software or malware and depends on observing the deviations of the malware from normal patterns of behavior.

Correct answer:

Data enrichment is correct. Data enrichment is the process of adding context and content to a piece of data, so that it may be viewed from multiple angles and at different levels of detail. This enables an analyst to view all aspects of a piece of data and more accurately correlate it with other pieces of data.

Incorrect answers:

Data management is incorrect. Data management refers to the overall management of all data in an organization.

Data aggregation is incorrect. Data aggregation refers to collecting and grouping different pieces of data.

Data correlation is incorrect. Data correlation refers to the activities involved in establishing a relationship between two different pieces of data.

Correct answer:

Session management is correct. Session management is a secure programming technique used to ensure that the sequence of requests and responses transferred during a communications session between the client and server, such as any session IDs and other sensitive information, is protected.

Incorrect answers:

Input validation is incorrect. Input validation is a technique of validating user input to ensure that it does not contain errors or parameters outside of the ability of the application to handle.

Parameterized queries is incorrect. A parameterized query (also known as a prepared statement) is a programming technique that treats user inputs as parameters to a function instead of substrings in a literal query.

Authentication is incorrect. Authentication is used in secure programming to ensure that users are properly identified and authenticated to the application.

Correct answer:

Compensating controls is correct. Compensating controls are used to mitigate weaknesses caused by insufficient or absent controls. They may be used in place of preferred controls if those controls are not available for whatever reason.

Incorrect answers:

Corrective controls is incorrect. Corrective controls are temporary in nature and are used to correct an immediate security issue, with the understanding that they will be placed by more permanent controls as soon as practical

Managerial controls is incorrect. Managerial controls consist of policies, procedures, and standards and are directed by management. They may or may not be used as compensating controls when needed.

Operational controls is incorrect. Operational controls apply to operational levels of the organization and include physical and environmental controls. They may or may not be used as compensating controls when needed.