PrepAway - Latest Free Exam Questions & Answers

what should be done?

A security administrator has been tasked with assisting in the forensic investigation of an incident relating to
employee misconduct. The employee’s supervisor believes evidence of this misconduct can be found on the
employee’s assigned workstation. Which of the following choices BEST describes what should be done?
(Choose two.)

PrepAway - Latest Free Exam Questions & Answers

Record time as offset as required and conduct a timeline analysis

Update antivirus definitions and conduct a full scan for infected files

Analyze network traffic, system, and file logs

Create an additional local admin account on that workstation to conduct work from

Delete other user profiles on the system to help narrow down the search space

Patch the system before reconnecting it to the network

Leave a Reply