CompTIA
JK0-018 · Question #551
JK0-018 Question #551: Real Exam Question with Answer & Explanation
The correct answer is A. Chain of custody. See the full explanation below for the reasoning.
Question
The security manager received a report that an employee was involved in illegal activity and has saved data to a workstation's hard drive. During the investigation, local law enforcement's criminal division confiscates the hard drive as evidence. Which of the following forensic procedures is involved?
Options
- AChain of custody
- BSystem image
- CTake hashes
- DOrder of volatility
Community Discussion
No community discussion yet for this question.