TestOut 12.2 - Incident Response - Practice Questions 12.2.4

The chain of custody is used for what purpose?

Which of the following is an important aspect of evidence gathering?

You have been asked to draft a document related to evidence gathering that contains details about personnel in possession and control of evidence from the time of discovery up through the time of presentation in court. What type of document is this?

When conducting a forensic investigation, and assuming that the attack has been stopped, which of the following actions should you perform first?

The immediate preservation of evidence is paramount when conducting a forensic analysis. Which of the following actions is most likely to destroy critical evidence?

A security incident is currently occuring on the company network. You discover that the attack involves a computer system that is attached to the network. You're not sure yet exactly what kind of damage is being done to the network systems or data. What action should you take first?