GIAC Exam GCED Topic 5 Question 5 Discussion

Actual exam question for GIAC's GCED exam

Question #: 5
Topic #: 5

[All GCED Questions]

Of the following pieces of digital evidence, which would be collected FIRST from a live system involved in an incident?

AEvent logs from a central repository

BDirectory listing of system files

CMedia in the CDrom drive

DSwap space and page files

Show Suggested Answer

Suggested Answer: D

Best practices suggest that live response should follow the order of volatility, which means that you want to collect data which is changing the most rapidly. The order of volatility is:

Memory

Swap or page file

Network status and current / recent network connections

Running processes

Open files

by Antione at May 07, 2022, 01:57 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!