Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA CySA+ Cybersecurity Analyst · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The analyst should take A. Clone the virtual server for forensic analysis first, because it preserves a point-in-time copy of the system for evidence-based investigation without altering logs or artifacts through interactive access or disruptive actions.
The question doesn't mention if it is VM, BUT, cloning is used loosely here, means preserving the evidence by taking copy/cloning if it is VM/forensic imaging of a disk if it is a machine. If you try eliminating answers, there is only A left . B is incorrect as you risk to alter the timestamps of logs and escalating the incidend by logging in the server, so you will lose the evidence which is very bad for forensics(legal actions against yourself)
The answer is A not B , why would log with your credentials to the affected system and review logs, when you can clone the virtual server, , for forensic analysis , and do anything else from there, ? , plus the question is a bit weird ,is formed in a weird way , , bc i get that is does not states it is a virtual server, it just says a server, so we will never know which type of server is it ig , but im going with A based on process of elimination , plus A seems to avoid contamination as well