A system administrator is responding to a legal order to turn over all logs from all company
servers. The system administrator records the system time of all servers to ensure that:

A system administrator is responding to a legal order to turn over all logs from all company
servers. The system administrator records the system time of all servers to ensure that:

A recent intrusion has resulted in the need to perform incident response procedures. The incident
response team has identified audit logs throughout the network and organizational systems which
hold details of the security breach. Prior to this incident, a security consultant informed the
company that they needed to implement an NTP server on the network. Which of the following is a
problem that the incident response team will likely encounter during their assessment?

Computer evidence at a crime scene is documented with a tag stating who had possession of the
evidence at a given time.
Which of the following does this illustrate?

A compromised workstation utilized in a Distributed Denial of Service (DDOS) attack has been
removed from the network and an image of the hard drive has been created. However, the system
administrator stated that the system was left unattended for several hours before the image was
created. In the event of a court case, which of the following is likely to be an issue with this
incident?

A compromised workstation utilized in a Distributed Denial of Service (DDOS) attack has been
removed from the network and an image of the hard drive has been created. However, the system
administrator stated that the system was left unattended for several hours before the image was
created. In the event of a court case, which of the following is likely to be an issue with this
incident?

The security manager received a report that an employee was involved in illegal activity and has
saved data to a workstation’s hard drive. During the investigation, local law enforcement’s criminal
division confiscates the hard drive as evidence. Which of the following forensic procedures is
involved?

The security manager received a report that an employee was involved in illegal activity and has
saved data to a workstation’s hard drive. During the investigation, local law enforcement’s criminal
division confiscates the hard drive as evidence. Which of the following forensic procedures is
involved?

Which of the following is the MOST important step for preserving evidence during forensic
procedures?

Which of the following is the MOST important step for preserving evidence during forensic
procedures?