Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA CySA+ Cybersecurity Analyst · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The key clue is "Best step to preserve evidence." The analyst needs to preserve the laptop's data and verify that it has not been modified. - Forensic image → Creates a bit-for-bit copy of the hard drive, including deleted-file remnants and metadata. - SHA-1 hash → Creates a digital fingerprint to help verify evidence integrity.
Correct Answer: D. Analysis: Making a forensic image of the device and creating a SHA-1 hash is the best step to preserve evidence. This process ensures that a bit-by-bit copy of the device is taken, preserving the original state of the data for future analysis and investigation. The SHA-1 hash provides a cryptographic verification that the copy is identical to the original, which is crucial for maintaining the integrity of the evidence.
since they mentioned that the employee was suspended. They are indicating that he will no longer be using his machine until the investigation is done. C sounds about right.