PrepAway - Latest Free Exam Questions & Answers

Which of the following procedures should the administra…

An intrusion has occurred in an internet facing system. The security administrator would like to gather forensic
evidence while the system is still in operation. Which of the following procedures should the administrator
perform FIRST on the system?

PrepAway - Latest Free Exam Questions & Answers

A.
Make a drive image

B.
Take hashes of system data

C.
Collect information in RAM

D.
Capture network traffic

PrepAway - Latest Free Exam Questions & Answers

Leave a Reply