Which of the following representatives of the incident response team takes forensic backups of
systems that are the focus of an incident?

A.
Technical representative

B.
Lead investigator

C.
Information security representative

D.
Legal representative

Explanation:

A technical representative creates forensic backups of systems that are the focus of an incident
and provides valuable information about the configuration of the network and target system.
Answer option B is incorrect. A lead investigator acts as the manager of the computer security
incident response team.
Answer option D is incorrect. The legal representative looks after legal issues and ensures that the
investigation process does not break any law.
Answer option C is incorrect. The information security representative informs about the security
safeguards that may affect their ability to respond to the incident.