GIAC
GCFE · Question #69
You are tasked with collecting evidence from a running system suspected of being involved in a cyberattack. Which steps should you prioritize to preserve volatile data while ensuring data integrity?…
The correct answer is A. Capture RAM contents using a live acquisition tool C. Use a write blocker when imaging hard drives D. Document the chain of custody for all collected evidence. See the full explanation below for the reasoning.
Question
You are tasked with collecting evidence from a running system suspected of being involved in a cyberattack. Which steps should you prioritize to preserve volatile data while ensuring data integrity? (Choose three)
Options
- ACapture RAM contents using a live acquisition tool
- BShutdown the system to avoid further changes
- CUse a write blocker when imaging hard drives
- DDocument the chain of custody for all collected evidence
- EDefragment the hard drive for better performance
How the community answered
(35 responses)- A71% (25)
- B17% (6)
- E11% (4)
Community Discussion
No community discussion yet for this question.