Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

GIAC GCED Exam - Topic 3 Question 80 Discussion

Actual exam question for GIAC's GCED exam

Question #: 80
Topic #: 3

[All GCED Questions]

Which type of media should the IR team be handling as they seek to understand the root cause of an incident?

ARestored media from full backup of the infected host

BMedia from the infected host, copied to the dedicated IR host

COriginal media from the infected host

DBit-for-bit image from the infected host

Show Suggested Answer

Suggested Answer: A

By imaging the media with tools such as dd or Ghost and analyzing the copy, you preserve the original media for later analysis so that the results can be recreated by another competent examiner if necessary.

by Tresa at Jun 17, 2026, 02:54 AM

Limited Time Offer

25%

Off

Get Premium GCED Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Oretha

2 days ago

I’m a bit confused about whether the restored media would have all the necessary details. Would it really help in understanding the root cause?

upvoted 0 times

...

Emmett

7 days ago

I remember practicing a question similar to this, and I think a bit-for-bit image is crucial for analysis without altering anything.

upvoted 0 times

...

Brandee

12 days ago

I think the original media from the infected host might be the best choice since it has all the data intact, but I'm not entirely sure.

upvoted 0 times

...