CS0-004: CompTIA Cybersecurity Analyst (CySA+)

By CompTIA · Question Mode

QuestionQ20

Incident Response and Management

A security analyst is notified of a potential data breach. The report identifies unauthorized, recent access dates for files located in the following personnel archives:

Question Image

Which action should the analyst take first?

Explanation

A legal hold preserves potentially relevant personnel files, logs, and other records so they remain available for investigation, litigation, and regulatory obligations. Incident data and metadata should be retained with their integrity and provenance preserved before performing investigative or remediation activities.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!