A user reports that the workstation next to them has prohibited material on the screen. Which of the following should the technician do FIRST?

The correct answer is C. Identify what files are open. The FIRST step in any security incident is to preserve and document evidence before taking any action that could destroy it. Identifying what files are open captures the current state of the system - which is critical for any subsequent investigation or disciplinary/legal…

Hardware and network troubleshooting

Question

Options

AUnplug the network
BAsk the user for their password
CIdentify what files are open
DPower off the workstation

How the community answered

(51 responses)

A
8% (4)
B
4% (2)
C
76% (39)
D
12% (6)

Explanation

The FIRST step in any security incident is to preserve and document evidence before taking any action that could destroy it. Identifying what files are open captures the current state of the system - which is critical for any subsequent investigation or disciplinary/legal action. Powering off the workstation (D) would destroy volatile data in RAM and close open files, potentially eliminating evidence. Unplugging the network (A) may be appropriate later to contain the incident but is not the first step. Asking for the user's password (B) is inappropriate and irrelevant at this stage. Document first, then escalate per your incident response policy.

Topics

#incident response#prohibited content#workstation security#first response

Community Discussion

No community discussion yet for this question.

Full 220-801 Practice