IsacaIsaca
CISA · Question #217
CISA Question #217: Real Exam Question with Answer & Explanation
Sign in or unlock CISA to reveal the answer and full explanation for question #217. The question stem and answer options stay visible for context.
Submitted by parkjh· Apr 18, 2026Information Systems Operations and Business Resilience
Question
Which of the following should be done FIRST following an incident that has caused internal servers to be inaccessible, disrupting normal business operations?
Options
- AMake a bit-level copy of the affected servers and calculate the hash value of the copy.
- BCopy all key directories and files on the affected servers and generate the hash value of the copy.
- CUnplug all power cables immediately to prevent further actions of the attacker on the servers.
- DDocument the servers' dates, times, and locations, as well as the individual who last used them.
Unlock CISA to see the answer
You've previewed enough free CISA questions. Unlock CISA for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Incident Response#Digital Forensics#Evidence Preservation#Forensic Imaging