Câu 88: SY0-401: CompTIA Security+

In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in question from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis? (Choose two.)

1. A. Take hashes — đáp án hiện tại
2. B. Begin the chain of custody paperwork
3. C. Take screen shots
4. D. Capture the system image — đáp án hiện tại
5. E. Decompile suspicious files