A security engineer discovers a PC may have been breached and accessed by an outside agent. The engineer wants to find out how this breach occurred before remediating the damage. Which of the following should the security engineer do FIRST to begin this investigation?
A) Create an image of the hard drive
B) Capture the incoming and outgoing network traffic
C) Dump the contents of the RAM
D) Parse the PC logs for information on the attacker

Question

Quizplus · Accepted Answer

Creating an image of the hard drive is crucial to preserve the current state of the system for further analysis and investigation without altering any data.

A Security Engineer Discovers a PC May Have Been Breached