MENU
Which type of media should the IR team be handling as they seek to understand the root cause of an incident?
Suggested Answer: A
Get Premium GCED Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
By imaging the media with tools such as dd or Ghost and analyzing the copy, you preserve the original media for later analysis so that the results can be recreated by another competent examiner if necessary.
12 comments · newest first
LO
Loreen
2 months ago
A is risky. Restored media might miss critical evidence.
DA
Dacia
2 months ago
I agree, but C could work too. Original media might show hidden issues.
LA
Larae
2 months ago
I think D is the best choice. Bit-for-bit gives the most accurate data.
TY
Tyisha
2 months ago
Isn't B risky? You might miss some crucial data from the original.
NA
Natalie
2 months ago
I disagree, A is too outdated for accurate analysis.
LA
Lavonne
2 months ago
A bit surprised that people overlook C, it has its merits too.
LU
Luther
3 months ago
Definitely agree with D, you get the whole picture!
LI
Lindsey
3 months ago
I think D is the best choice for a thorough investigation.
XE
Xenia
3 months ago
I feel like the media from the infected host copied to the dedicated IR host could be useful, but I wonder if it would miss some critical evidence.
OR
Oretha
3 months ago
I’m a bit confused about whether the restored media would have all the necessary details. Would it really help in understanding the root cause?
EM
Emmett
3 months ago
I remember practicing a question similar to this, and I think a bit-for-bit image is crucial for analysis without altering anything.
BR
Brandee
4 months ago
I think the original media from the infected host might be the best choice since it has all the data intact, but I'm not entirely sure.