Exam CAS-004 topic 1 question 537 discussion

The immediate action should be to preserve all relevant evidence to ensure it remains intact for any potential investigations. Taking a system snapshot involves creating a forensic image of the system, capturing the current state of all data, including log files, system configurations, and potentially volatile data. This action ensures that the evidence is collected in a manner that is admissible in court, maintaining the integrity and chain of custody of the data. By taking a snapshot, the security manager minimizes the risk of data being altered, overwritten, or lost due to ongoing system processes. The process should be thoroughly documented, including timestamps and the methods used to collect the data, to establish credibility.

Ans. D. Take a system snapshot to preserve any evidence. Preserving evidence is crucial in cases involving potential criminal activity. A system snapshot allows you to capture the current state of the system, including all log files and relevant data, ensuring that you have a reliable record to refer to later. This step is essential before taking any other actions that might alter or compromise the data.