Preserving useful evidence during a device incident
A fictional analyst finds suspicious activity on a managed device. Which action best supports further investigation while following the organization’s response process?
A
Announce that a particular person is responsible without checking the records.
B
Continue all suspicious activity indefinitely to avoid inconveniencing anyone.
C
Preserve relevant logs and timestamps, document observations, and follow approved containment and escalation procedures.
D
Immediately erase every log before anyone reviews it.
Question Leaderboard
Not enough data yet to show leaderboard.