CISM: Certified Information Security ManagerDemo

Question

Before conducting a forensic examination, an information security manager should:

A boot the original hard disk on a clean system.
B create an image of the original data on new media.
C duplicate data from the backup media.
D shut down and relocate the server.

Explanation

Forensic evidence should be preserved in its original state. A forensic image created on new media provides a working copy for examination while keeping the original data intact and minimizing the risk of alteration.

CISM: Certified Information Security ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ922

Community Discussion