Free CompTIA CySA+ CS0-003 Practice Question
While responding to an incident, you've been asked to ensure the data integrity of logs that may contain evidence of malicious activity. What is the first step you should take to validate the integrity of these logs?
Calculate and securely record the hash values of the files and logs using a standardized hashing algorithm.
Use a proprietary algorithm to encrypt the files and logs to prevent unauthorized modification.
Ensure all logs are time-stamped so that you can validate data was not altered based on the time of recording.
Take a complete copy of the logs and store them in a secure location before any analysis or hash calculations.
This question's topic:
CompTIA CySA+ CS0-003 /
Incident Response and Management
SAVE $49