The security officer is preparing a read-only USB stick with a document of important personal phone numbers, vendor contacts, an MD5 program, and other tools to provide to employees. At which of the…

The correct answer is B. First Responder. The USB stick is a first-responder toolkit. At the First Responder stage, personnel need to contact the appropriate people (phone numbers, vendor contacts), verify the integrity of files or evidence using hashing tools like MD5, and use forensic utilities - all before evidence…

Security operations

Question

The security officer is preparing a read-only USB stick with a document of important personal phone numbers, vendor contacts, an MD5 program, and other tools to provide to employees. At which of the following points in an incident should the officer instruct employees to use this information?

Options

ABusiness Impact Analysis
BFirst Responder
CDamage and Loss Control
DContingency Planning

How the community answered

(52 responses)

A
4% (2)
B
87% (45)
C
2% (1)
D
8% (4)

Explanation

The USB stick is a first-responder toolkit. At the First Responder stage, personnel need to contact the appropriate people (phone numbers, vendor contacts), verify the integrity of files or evidence using hashing tools like MD5, and use forensic utilities - all before evidence is altered. Business Impact Analysis and Contingency Planning are pre-incident, preparedness-phase activities. Damage and Loss Control occurs later in the incident lifecycle, after initial response and containment. The read-only nature of the USB protects tool integrity so hashes and utilities are trustworthy when used during the initial response.

Topics

#incident response#first responder#forensic toolkit#evidence handling

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice