Which of the following should the junior analyst have followed?

During a security event investigation, a junior analyst fails to create an image of a server’s hard drive before removing the drive and sending it to the forensics analyst. Later, the evidence from the analysis is not usable in the prosecution of the attackers due to the uncertainty of tampering.

Which of the following should the junior analyst have followed?
A . Continuity of operations
B . Chain of custody
C . Order of volatility
D . Data recovery

Answer: C

Latest CAS-003 Dumps Valid Version with 509 Q&As

Latest And Valid Q&A | Instant Download | Once Fail, Full Refund

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>