Câu 78: CAS-003: CompTIA Advanced Security Practitioner (CASP) CAS-003
During a security event investigation, a junior analyst fails to create an image of a server's hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from the analysis is not usable in the prosecution of the attackers due to the uncertainty of tampering. Which of the followin…
Nội dung câu hỏi
During a security event investigation, a junior analyst fails to create an image of a server's hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from the analysis is not usable in the prosecution of the attackers due to the uncertainty of tampering. Which of the following should the junior analyst have followed?
Các lựa chọn
Đáp án được giữ gọn theo nhãn A, B, C, D trong phần bình chọn tương tác.
- A. Continuity of operations
- B. Chain of custody
- C. Order of volatility — đáp án hiện tại
- D. Data recovery
Cộng đồng
0 bình luận công khai. Tên thành viên được ẩn một phần.