Which of the following will the incident handler MOST likely do to preserve the evidence?

An incident handler needs to preserve evidence for possible litigation.

Which of the following will the incident handler MOST likely do to preserve the evidence?
A . Encrypt the files
B. Clone any impacted hard drives
C. Contact the cyber insurance company
D. Inform law enforcement

View Answer

Answer: B

Explanation:

The incident handler should clone any impacted hard drives to preserve evidence for possible litigation1