An intrusion has occurred in an internet facing system. The security administrator would like to gather forensic evidence while the system is still in operation. Which of the following procedures should the administrator perform FIRST on the system?
A. Make a drive image
B. Take hashes of system data
C. Collect information in RAM
D. Capture network traffic
Answer: D. Capture network traffic
You might also like to view...
In addition to Tiger, both ESM and CoolStreaming also support streaming access to the same movie by potentially large numbers of users. Discuss the strategies adopted by both ESM and CoolStreaming for managing such simultaneous access and compare the approaches to those advocated by Tiger
What will be an ideal response?
Using what Windows 7 utility allows you to create a backup schedule that can include any folder on the hard drive and the system image?
A. Automated System Backup B. Complete PC Recovery C. Automated System Recovery D. Backup and Restore
To terminate a slide show, you press ________
A) B) Esc C) F3 D) F5
The UPPER function converts all letters of each word in a text string to uppercase.?
Answer the following statement true (T) or false (F)