Mysystem.org IT ExamsCISM Question 39 2017-04-07
Question: A root kit was used to capture detailed accounts receivable information. To ensure admissibility of evidence from a legal standpoint, once the incident was identified and the server isolated, the next step should be to:
A.) document how the attack occurreD.)
B.) notify law enforcement.
Answer ==> C.) take an image copy of the mediA.)
D.) close the accounts receivable system.