Question

A technician is dispatched to a workstation suspected of being involved in the leak of confidential company files. As the technician investigates, which action is the MOST important to perform throughout the incident-response process to protect the integrity of any future investigation or legal proceedings?

Accepted Answer

Continuously document every action taken, including who accessed the system and when

Answer

Immediately reimage the workstation to remove any malicious software

Answer

Post details of the incident in the shared team knowledge base for visibility

Answer

Restart the workstation to clear volatile memory before examining it