CS0-003 · Question #65
During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured
The correct answer is A. Clone the virtual server for forensic analysis. The first action that the analyst should take in this case is to clone the virtual server for forensic analysis. Cloning the virtual server involves creating an exact copy or image of the server's data and state at a specific point in time. Cloning the virtual server can help pre
Question
During an extended holiday break, a company suffered a security incident. This information was properly relayed to appropriate personnel in a timely manner and the server was up to date and configured with appropriate auditing and logging. The Chief Information Security Officer wants to find out precisely what happened. Which of the following actions should the analyst take first?
Options
- AClone the virtual server for forensic analysis
- BLog m to the affected server and begin analysis of the logs
- CRestore from the last known-good backup to confirm there was no loss of connectivity
- DShut down the affected server immediately
How the community answered
(41 responses)- A78% (32)
- B2% (1)
- C7% (3)
- D12% (5)
Explanation
The first action that the analyst should take in this case is to clone the virtual server for forensic analysis. Cloning the virtual server involves creating an exact copy or image of the server's data and state at a specific point in time. Cloning the virtual server can help preserve and protect any evidence or information related to the security incident, as well as prevent any tampering, contamination, or destruction of evidence. Cloning the virtual server can also allow the analyst to safely analyze and investigate the incident without affecting the original server or its operations.
Topics
Community Discussion
No community discussion yet for this question.