Free CompTIA CySA+ CS0-003 Practice Question
An organization has discovered suspicious activity suggesting a potential breach of their financial database. As part of the incident response, the analyst must ensure the admissibility of logs as evidence. What is the most appropriate step for the analyst to take immediately after isolating the affected system to ensure that the logs can be used for legal proceedings?
Generate and document cryptographic hashes of the logs to ensure their integrity
Apply secure time-stamping protocols to the logs to prevent future alterations
Create a detailed procedure log for the incident response steps taken
Encrypt the logs with a public key to secure the contents from unauthorized access
This question's topic:
CompTIA CySA+ CS0-003 /
Incident Response and Management
SAVE $49