The security operations team is conducting a mock forensics investigation. Which of the following should be the FIRST action taken after seizing a compromised workstation?
A. Activate the escalation checklist
B. Implement the incident response plan
C. Analyze the forensic image
D. Perform evidence acquisition
CS0-002: CompTIA CySA+ ExamFULL Printable PDF and Software. VALID exam to help you PASS. |
 |
