CS0-003: CompTIA Cybersecurity Analyst (CySA+)

Question

A security analyst is responding to an incident involving a malicious attack on a network data closet. Which option best describes how the analyst should properly document the incident?

Explanation

Photographs preserve the physical condition, arrangement, and connections of affected equipment as evidence before the scene is altered. NIST incident-forensics guidance recommends photographing evidence to retain visual records of computer setups and peripheral devices, alongside detailed evidence-handling documentation.

Learn more

NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

CS0-003: CompTIA Cybersecurity Analyst (CySA+)

AstroTutor

Notes

Readiness

QuestionQ3

Community Discussion