Question: A root kit was used to capture detailed accounts receivable information. To ensure admissibility of evidence from a legal standpoint, once the incident was identified and the server isolated, the next step should be to:
A.) document how the attack occurreD.)
B.) notify law enforcement.
C.) take an image copy of the mediA.)
D.) close the accounts receivable system.

Download pdf (with explanations) edition of this exam.