Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

GIAC GCED Exam - Topic 3 Question 80 Discussion

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?
A) Restored media from full backup of the infected host
B) Media from the infected host, copied to the dedicated IR host
C) Original media from the infected host
D) Bit-for-bit image from the infected host

GIAC GCED Exam - Topic 3 Question 80 Discussion

Actual exam question for GIAC's GCED exam
Question #: 80
Topic #: 3
[All GCED Questions]

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

Show Suggested Answer Hide Answer
Suggested Answer: A

By imaging the media with tools such as dd or Ghost and analyzing the copy, you preserve the original media for later analysis so that the results can be recreated by another competent examiner if necessary.


by Tresa at Jun 17, 2026, 02:54 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Loreen
3 days ago
A is risky. Restored media might miss critical evidence.
upvoted 0 times
...
Dacia
8 days ago
I agree, but C could work too. Original media might show hidden issues.
upvoted 0 times
...
Larae
13 days ago
I think D is the best choice. Bit-for-bit gives the most accurate data.
upvoted 0 times
...
Tyisha
19 days ago
Isn't B risky? You might miss some crucial data from the original.
upvoted 0 times
...
Natalie
24 days ago
I disagree, A is too outdated for accurate analysis.
upvoted 0 times
...
Lavonne
29 days ago
A bit surprised that people overlook C, it has its merits too.
upvoted 0 times
...
Luther
1 month ago
Definitely agree with D, you get the whole picture!
upvoted 0 times
...
Lindsey
1 month ago
I think D is the best choice for a thorough investigation.
upvoted 0 times
...
Xenia
1 month ago
I feel like the media from the infected host copied to the dedicated IR host could be useful, but I wonder if it would miss some critical evidence.
upvoted 0 times
...
Oretha
2 months ago
I’m a bit confused about whether the restored media would have all the necessary details. Would it really help in understanding the root cause?
upvoted 0 times
...
Emmett
2 months ago
I remember practicing a question similar to this, and I think a bit-for-bit image is crucial for analysis without altering anything.
upvoted 0 times
...
Brandee
2 months ago
I think the original media from the infected host might be the best choice since it has all the data intact, but I'm not entirely sure.
upvoted 0 times
...

Save Cancel