GIAC
GCED · Question #90
GCED Question #90: Real Exam Question with Answer & Explanation
The correct answer is B. The contents of physical memory. See the full explanation below for the reasoning.
Question
When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?
Options
- AThe network connections and open ports
- BThe contents of physical memory
- CThe current routing table
- DA list of the running services
Community Discussion
No community discussion yet for this question.