Which of the following should Bill, a security administrator, perform before a hard drive is analyzed with forensics tools?

  • Identify user habits
  • Interview witnesses
  • Capture system image
  • Disconnect system from network

CompTIA Security+ SY0-401
  • Network Security
  • Compliance and Operational Security
    • This question is filed here
  • Threats and Vulnerabilities
  • Application, Data and Host Security
  • Access Control and Identity Management
  • Cryptography