Question: If an organization considers taking legal action on a security incident, the information security manager should focus PRIMARILY on:
A.) obtaining evidence as soon as possible.
B.) preserving the integrity of the evidence.
C.) disconnecting all IT equipment involveD.)
D.) reconstructing the sequence of events.

Download pdf (with explanations) edition of this exam.