While an employee is on vacation, suspicion arises that the employee has been involved in malicious activity on the network. The security engineer is concerned the investigation may need to continue…

Question

Options

• ACreate archival copies of all documents and communications related to the employee
• BCreate a forensic image of network infrastructure devices
• CCreate an image file of the employee's network drives and store it with hashes
• DInstall a keylogger to capture the employee's communications and contacts

• A
  3% (1)
• B
  10% (4)
• C
  15% (6)
• D
  73% (29)

Explanation

This answer key appears to contain an error. The correct answer should be C. When an investigation is underway, maintaining evidentiary integrity requires creating a forensic image of the employee's network drives and storing it alongside cryptographic hashes (e.g., MD5/SHA-256). The hashes serve as a tamper-evident seal - any modification to the image would produce a different hash value, proving the evidence was altered. This is standard digital forensics practice (chain of custody). Installing a keylogger (D) is active surveillance going forward, not evidence preservation, and may violate wiretapping laws without proper authorization. Option A captures documents but misses live system state. Option B images network infrastructure, which is not the primary source of the suspect employee's activity.

No community discussion yet for this question.