A security incident occurs that requires a systems administrator to take an image of a user's workstation hard drive. Which of the following should be taken at the time the system image is generated and retained through the file of the investigation to assure files have not been modified since?
A. A checksum hash of the drive image or files
B. Copies of the system logs at specific intervals
C. A snapshot of the file system
D. The user's credentials and permissions
Answer: A. A checksum hash of the drive image or files
Computer Science & Information Technology
You might also like to view...
________ within a document refer to sources listed in the bibliography
Fill in the blank(s) with correct word
Computer Science & Information Technology
The ____________________ exception type occurs when a procedure is called and the result is not possible.
Fill in the blank(s) with the appropriate word(s).
Computer Science & Information Technology