Question 1 of 30
Examination of the data shows a potential internal data leak originating from a specific employee\'s workstation. As the cybersecurity analyst tasked with investigating, what is the most appropriate initial action to preserve the integrity of potential digital evidence from the workstation?
Create a forensically sound image of the workstation's storage media, ensuring all metadata is preserved, and then conduct analysis on the image, meticulously documenting every step of the acquisition and analysis process.
Immediately access the employee's workstation and copy all relevant files to a separate drive for review, relying on the operating system's default file copying functions.
Instruct the employee to power down their workstation and then manually collect files that appear suspicious based on their file names and recent modification dates.
Transfer the workstation to a general IT support technician who can perform a basic file search for relevant documents.

Preparing for CompTIA CySA+ Exam? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free