Which of the following representatives of incident response team takes forensic backups of the
systems that are the focus of the incident?

A.
Legal representative

B.
Technical representative

C.
Lead investigator

D.
Information security representative

Explanation:
Technical representative creates forensic backups of the systems that are the focus of the incident,
and provides valuable information about the configuration of the network and target system.
Answer option C is incorrect. Lead investigator acts as the manager of the computer security
incident response team.
Answer option A is incorrect. Legal representative looks after the legal issue and ensures that the
investigation process does not break any law.
Answer option D is incorrect. Information security representative informs about the security
safeguards that may affect their ability to respond to the incident.
CHFI Course Manual, Contents. “Incident Response”