Multiple Choice
An incident responder is preparing to acquire images and files from a workstation that has been compromised. The workstation is still powered on and running. Which of the following should be acquired LAST?
A) Application files on hard disk
B) Processor cache
C) Processes in running memory
D) Swap space
Correct Answer:
Verified
Correct Answer:
Verified
Q235: Which of the following scenarios would make
Q236: After successfully breaking into several networks and
Q237: Which of the following is commonly done
Q238: Which of the following works by implanting
Q239: Which of the following is the BEST
Q241: A security administrator has been assigned to
Q242: A penetration tester finds that a company's
Q243: An office recently completed digitizing all its
Q244: Which of the following would enhance the
Q245: In a corporation where compute utilization spikes