A security analyst is responding to an incident that involves a malicious attack on a network data closet. Which of the following best explains how the analyst should properly document the incident?

Question

Options

• ABack up the configuration file for all network devices.
• BRecord and validate each connection.
• CCreate a full diagram of the network infrastructure.
• DTake photos of the impacted items.

• B
  2% (1)
• C
  7% (3)
• D
  90% (38)

Explanation

Explanation

When responding to a physical incident in a network data closet, taking photos of the impacted items is the most appropriate form of documentation because it creates a visual, timestamped record of the physical evidence - preserving the scene in its original state for forensic investigation, legal proceedings, and incident reporting. This aligns with proper chain of custody procedures, which require capturing physical evidence before it is disturbed or altered.

• Option A (backing up configuration files) is a recovery/remediation step, not incident documentation of a physical attack.
• Option B (recording and validating connections) is a network auditing task, not a response to a physical intrusion.
• Option C (creating a network diagram) is a planning/documentation artifact unrelated to responding to an active physical incident.

Memory Tip: Think of a security analyst as a crime scene investigator - their first job is to photograph the evidence, just like police do before touching anything. "Physical attack = physical photos" will help you remember that documentation of physical incidents means visual evidence capture.

No community discussion yet for this question.