CS0-003: CompTIA Cybersecurity Analyst (CySA+)

By CompTIA · Question Mode

QuestionQ15

Incident Response and Management

An incident-response team discovered IoCs on a critical server. The team must isolate the server and gather technical evidence for further investigation. Which of the following data should be collected first to preserve sensitive information before isolating the server?

Explanation

Volatile network-state evidence should be captured before isolation because disconnecting a host can alter or eliminate it. The routing table records the system’s active network routing configuration, whereas disks, boot partitions, and files can be collected later as nonvolatile evidence. NIST guidance directs responders to capture volatile data, including network configuration information, as evidence.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!