Which of the following should the administrator use?

exams SY0-501 SY0-501 exam 0 Comments

A security administrator suspects an employee has been emailing proprietary information to a competitor. Company policy requires the administrator to capture an exact copy of the employee’s hard disk.

Which of the following should the administrator use?
A . dd
B . chmod
C . dnaenum
D . logger

Answer: A