GIAC

GCED · Question #8

What should happen before acquiring a bit-for-bit copy of suspect media during incident response?

The correct answer is B. Create a one-way hash of the original media. You've hit your limit · resets 1pm (America/New_York)

Data Protection and Incident Response

Question

What should happen before acquiring a bit-for-bit copy of suspect media during incident response?

Options

AEncrypt the original media to protect the data
BCreate a one-way hash of the original media
CDecompress files on the original media
DDecrypt the original media

How the community answered

(23 responses)

B
87% (20)
C
4% (1)
D
9% (2)

Explanation

You've hit your limit · resets 1pm (America/New_York)

Topics

#forensic imaging#chain of custody#hash verification#evidence integrity

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion

Full GCED Practice