In the initial stages of an incident response, Matt, the security administrator, was provided the hard drives in QUESTION NO: from the incident manager. Which of the following incident response procedures would he need to perform in order to begin the analysis?
A. Take hashes
B. Begin the chain of custody paperwork
C. Take screen shots
D. Capture the system image
E. Decompile suspicious files
Answer:
A. Take hashes
D. Capture the system image
You might also like to view...
Which one of the following Button control names is a legal C# identifier?
a. Display Option 5 Button b. Exit! Button c. *Clear*Button* d. delete Record Button
The access method used by wireless networks is
A) Token passing B) CSMA/CA C) CSMA/CD D) mesh
The source code for PHP can be viewed in the client browser.
Answer the following statement true (T) or false (F)
If a temporary worker (temp) violates a policy or causes a problem, what is the strongest action that the host organization can usually take, depending on the SLA?
A. Nothing, the organization has no control over temps. B. Terminate the relationship with the individual and request that he or she be censured. C. Fine the temp or force the temp to take unpaid leave, like permanent employees. D. Sue the temp agency for cause, demanding reparations for the actions of the temp.