An incident involving a workstation that is potentially infected with a virus has occurred. The workstation may have sent confidential data to an unknown internet server. Which of the following should a security analyst do FIRST?

Question

Quizplus · Accepted Answer

The first step in handling a potential incident is to preserve evidence. Making a copy of everything in memory ensures that volatile data is captured for further analysis.

An Incident Involving a Workstation That Is Potentially Infected with a Virus