A Security Incident May Have Occurred on the Desktop PC

question 58

Multiple Choice

A security incident may have occurred on the desktop PC of an organization's Chief Executive Officer (CEO) . A duplicate copy of the CEO's hard drive must be stored securely to ensure appropriate forensic processes and the chain of custody are followed. Which of the following should be performed to accomplish this task?

• A) Install a new hard drive in the CEO's PC, and then remove the old hard drive and place it in a tamper-evident bag.
• B) Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy. Connect a write blocker to the hard drive. Then, leveraging a forensic workstation, utilize the dd command in a live Linux environment to create a duplicate copy.
• C) Remove the CEO's hard drive from the PC, connect to the forensic workstation, and copy all the contents onto a remote fileshare while the CEO watches.
• D) Refrain from completing a forensic analysis of the CEO's hard drive until after the incident is confirmed; duplicating the hard drive at this stage could destroy evidence.

---

Definitions:

Buyer's Belief

The perceptions and assumptions that consumers hold about a product, service, or brand, influencing their purchasing decisions.

Exchange Function

The process in which goods, services, or assets are traded between parties.

Marketing Mix

A set of actions, or tactics, that a company uses to promote its brand or product in the market. It typically includes the 'Four Ps': product, price, place, and promotion.

Customer Needs

The essential requirements and desires of buyers that motivate them to make purchasing decisions.