CompTIA
SK0-004 · Question #449
SK0-004 Question #449: Real Exam Question with Answer & Explanation
Sign in or unlock SK0-004 to reveal the answer and full explanation for question #449. The question stem and answer options stay visible for context.
Question
A security incident occurs that requires a systems administrator to take an image of a user's workstation hard drive. Which of the following should be taken at the time the system image is generated and retained through the file of the investigation to assure files have not been modified since?
Options
- AA checksum hash of the drive image or files
- BCopies of the system logs at specific intervals
- CA snapshot of the file system
- DThe user's credentials and permissions
Unlock SK0-004 to see the answer
You've previewed enough free SK0-004 questions. Unlock SK0-004 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.