A coworker has reported that someone has engaged in prohibited activity. The supervisor has asked the technician to quarantine the PC until police arrive. Which of the following should the…

The correct answer is D. Document time/date for later reference E. Prevent users from accessing the PC. When a PC is involved in a potential criminal or policy violation, the priority is evidence preservation. Documenting the time and date creates an audit trail that may be needed in a legal proceeding. Preventing access to the PC ensures the evidence is not altered or destroyed…

Hardware

Question

A coworker has reported that someone has engaged in prohibited activity. The supervisor has asked the technician to quarantine the PC until police arrive. Which of the following should the technician do? (Select TWO).

Options

AAllow the user to continue working
BCheck for viruses
CRe-image the hard drive
DDocument time/date for later reference
EPrevent users from accessing the PC
FTurn off PC

How the community answered

(17 responses)

A
6% (1)
C
18% (3)
D
71% (12)
F
6% (1)

Explanation

When a PC is involved in a potential criminal or policy violation, the priority is evidence preservation. Documenting the time and date creates an audit trail that may be needed in a legal proceeding. Preventing access to the PC ensures the evidence is not altered or destroyed before authorities arrive. Allowing the user to continue working, checking for viruses, or re-imaging the drive would all destroy or compromise evidence. Turning off the PC could also alter volatile data (like RAM contents) and is generally discouraged unless instructed by law enforcement.

Topics

#chain of custody#incident response#prohibited activity#forensics

Community Discussion

No community discussion yet for this question.

Full 220-801 Practice