Why Is It Important for an Incident Responder to Copy

question 160

Multiple Choice

Why is it important for an Incident Responder to copy malicious files to the ATP file store or create an image of the infected system during the Recovery phase?

• A) To have a copy of the file policy enforcement
• B) To test the effectiveness of the current assigned policy settings in the Symantec Endpoint Protection Manager (SEPM)
• C) To create custom IPS signatures
• D) To document and preserve any pieces of evidence associated with the incident

---

Definitions:

Mortuary

A facility where the bodies of deceased persons are prepared for burial or cremation and where funerals might be conducted.

Legal Capacity

Legal capacity is the ability of an individual or entity to enter into legally binding contracts, sue or be sued, and make decisions that carry legal consequences.

Partnership Agreement

A legal document that outlines the rights, responsibilities, and other operational details among partners in a business venture.

Minor Partner

A partner in a business who has not reached the age of majority, limiting their legal capacity and liabilities within the partnership.