EC-Council
312-49V9 · Question #538
Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while…
The correct answer is A. Record the system state by taking photographs of physical system and the display. See the full explanation below for the reasoning.
Question
Smith, a network administrator with a large MNC, was the first to arrive at a suspected crime scene involving criminal use of compromised computers. What should be his first response while maintaining the integrity of evidence?
Options
- ARecord the system state by taking photographs of physical system and the display
- BPerform data acquisition without disturbing the state of the systems
- COpen the systems, remove the hard disk and secure it
- DSwitch off the systems and carry them to the laboratory
How the community answered
(41 responses)- A83% (34)
- B10% (4)
- C2% (1)
- D5% (2)
Community Discussion
No community discussion yet for this question.