Which of the following should the administrator use?

exams SY0-601 SY0-601 exam 0 Comments

A security administrator suspects an employee has been emailing proprietary information to a competitor. Company policy requires the administrator to capture an exact copy of the employee’s hard disk.

Which of the following should the administrator use?
A . dd
B . chmod
C . dnsenum
D . logger

Answer: A