When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?

exams GCED GCED exam 0 Comments

When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?
A . The network connections and open ports
B . The contents of physical memory
C . The current routing table
D . A list of the running services

Answer: B