An employee is suspected of misusing a company-issued laptop. The employee has been suspended pending an investigation by human resources. Which of the following is the best step to preserve evidence?

A. Disable the user’s network account and access to web resources.

B. Make a copy of the files as a backup on the server.

C. Place a legal hold on the device and the user’s network share.

D. Make a forensic image of the device and create a SHA-1 hash.








 

Suggested Answer: D

Community Answer: D



This question is in CS0-003 CompTIA Cybersecurity Analyst (CySA+) Exam
For getting CompTIA Cybersecurity Analyst (CySA+) Certificate



Disclaimers:
The website is not related to, affiliated with, endorsed or authorized by CompTIA. 
Trademarks, certification & product names are used for reference only and belong to CompTIA.
The website does not contain actual questions and answers from CompTIA's Certification Exams.