CompTIA
JK0-018 · Question #364
To ensure proper evidence collection, which of the following steps should be preformed FIRST?
The correct answer is C. Capture the system image. See the full explanation below for the reasoning.
Question
To ensure proper evidence collection, which of the following steps should be preformed FIRST?
Options
- ATake hashes from the live system
- BReview logs
- CCapture the system image
- DCopy all compromised files
How the community answered
(24 responses)- A4% (1)
- B8% (2)
- C83% (20)
- D4% (1)
Community Discussion
No community discussion yet for this question.