CAS-003 · Question #72
During an incident involving the company main database, a team of forensics experts is hired to respond to the breach. The team is in charge of collecting forensics evidence from the company's…
The correct answer is D. Secure the scene, take inventory, capture volatile storage, capture non-volatile storage. The scene has to be secured first to prevent contamination. Once a forensic copy has been created, an analyst will begin the process of moving from most volatile to least volatile information. The chain of custody helps to protect the integrity and reliability of the evidence…
Question
During an incident involving the company main database, a team of forensics experts is hired to respond to the breach. The team is in charge of collecting forensics evidence from the company's database server. Which of the following is the correct order in which the forensics team should engage?
Options
- ANotify senior management, secure the scene, capture volatile storage, capture non- volatile
- BTake inventory, secure the scene, capture RAM, capture hard drive, implement chain of custody,
- CImplement chain of custody, take inventory, secure the scene, capture volatile and non- volatile
- DSecure the scene, take inventory, capture volatile storage, capture non-volatile storage,
How the community answered
(29 responses)- A3% (1)
- B7% (2)
- C3% (1)
- D86% (25)
Explanation
The scene has to be secured first to prevent contamination. Once a forensic copy has been created, an analyst will begin the process of moving from most volatile to least volatile information. The chain of custody helps to protect the integrity and reliability of the evidence by keeping an evidence log that shows all access to evidence, from collection to appearance in
Topics
Community Discussion
No community discussion yet for this question.