A security analyst is responding to an indent that involves a malicious attack on a network. Data closet. Which of the following best explains how are analyst should properly document the incident?

The correct answer is D. Take photos of the impacted items. When documenting a physical incident in a network data closet, taking photos provides a clear and immediate record of the situation, which is essential for thorough incident documentation and subsequent investigation. Proper documentation of an incident in a data closet should…

Submitted by manish99· Mar 6, 2026Incident Response and Management

Question

Options

ABack up the configuration file for alt network devices
BRecord and validate each connection
CCreate a full diagram of the network infrastructure
DTake photos of the impacted items

How the community answered

(40 responses)

A
5% (2)
B
3% (1)
C
3% (1)
D
90% (36)

Explanation

When documenting a physical incident in a network data closet, taking photos provides a clear and immediate record of the situation, which is essential for thorough incident documentation and subsequent investigation. Proper documentation of an incident in a data closet should include taking photos of the impacted items. This provides visual evidence and helps in understanding the physical context of the incident, which is crucial for a thorough investigation. Backing up configuration files, recording connections, and creating network diagrams, while important, are not the primary means of documenting the physical aspects of an incident.

Topics

#Incident documentation#Evidence collection#Incident response

Community Discussion

No community discussion yet for this question.

Full CS0-003 Practice