Question: A desktop computer that was involved in a computer security incident should be secured as evidence by:
A.) disconnecting the computer from all power sources.
B.) disabling all local user accounts except for one administrator.
C.) encrypting local files and uploading exact copies to a secure server.
D.) copying all files using the operating system (OS) to write-once mediA.)

Download pdf (with explanations) edition of this exam.