PrepAway - Latest Free Exam Questions & Answers

Which of the following should have been done first?

Joe an employee has reported to Ann a network technician an unusual device plugged into a USB port on a
workstation in the call center. Ann unplugs the workstation and brings it to the IT department where an incident
is opened. Which of the following should have been done first?

PrepAway - Latest Free Exam Questions & Answers

A.
Notify the incident response team lead

B.
Document chain of custody

C.
Take a copy of volatile memory

D.
Make an image of the hard drive


Leave a Reply