CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

Question

A security analyst is notified of a potential data breach. The report identifies unauthorized, recent access dates for files located in the following personnel archives:

Question Image

Which action should the analyst take first?

A Perform log correlation.
B Reset user credentials.
C Restore files from backup.
D Establish a timeline.
E Establish a legal hold.

Explanation

A legal hold preserves potentially relevant personnel files, logs, and other records so they remain available for investigation, litigation, and regulatory obligations. Incident data and metadata should be retained with their integrity and provenance preserved before performing investigative or remediation activities.

Learn more

CS0-004: CompTIA Cybersecurity Analyst (CySA+)Demo

AstroTutor

Notes

Readiness

QuestionQ20

Community Discussion