Question 1
(Topic 1)
During an after-hours breach at a Boston data center, an on-duty responder is concerned about preserving in-memory runtime information (e.g., active process state, session data, and encryption material) for later analysis. Which action would most jeopardize preservation of this information?
Select an option, then click Submit answer.
- ○ Assuming that some components of the victim computer may be reliable and usable
- ○ Shutting down or rebooting the victim computer; in this case, all volatile data are lost
- ○ Failing to document the data-collection process
- ○ Not having access to baseline documentation about the victim computer
