GIAC Exam GCED Topic 2 Question 1 Discussion

Actual exam question for GIAC's GCED exam

Question #: 1
Topic #: 2

[All GCED Questions]

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

ARestored media from full backup of the infected host

BMedia from the infected host, copied to the dedicated IR host

COriginal media from the infected host

DBit-for-bit image from the infected host

Show Suggested Answer

Suggested Answer: A

By imaging the media with tools such as dd or Ghost and analyzing the copy, you preserve the original media for later analysis so that the results can be recreated by another competent examiner if necessary.

by Izetta at May 06, 2022, 05:15 PM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!