Which of the following representatives of the incident response team takes forensic backups of systems that are the focus of an incident?

Question

Options

• ATechnical representative
• BLead investigator
• CInformation security representative
• DLegal representative

• A
  88% (15)
• B
  6% (1)
• C
  6% (1)

Explanation

Technical representatives are responsible for the hands-on, technical aspects of incident response, including taking forensic backups (disk images, memory dumps, log captures) of affected systems - this requires specialized tools and technical expertise that define their role.

The lead investigator (B) coordinates the overall investigation and directs the team, but delegates the technical execution to others. The information security representative (C) focuses on policy, risk assessment, and ensuring the response aligns with security standards - not hands-on forensics. The legal representative (D) advises on liability, regulatory obligations, and evidence admissibility, not evidence collection itself.

Memory tip: Think "T for Technical = T for Tools." The person with the forensic tools in hand is always the technical rep - everyone else in the room is advising, directing, or documenting.

No community discussion yet for this question.