Which of the following should have been done first?

Joe an employee has reported to Ann a network technician an unusual device plugged into a USB port on a workstation in the call center. Ann unplugs the workstation and brings it to the IT department where an incident is opened.

Which of the following should have been done first?
A . Notify the incident response team lead
B . Document chain of custody
C . Take a copy of volatile memory
D . Make an image of the hard drive

View Answer

Answer: A