Isaca Certified Information Systems Auditor CISA Question # 202 Topic 21 Discussion
CISA Exam Topic 21 Question 202 Discussion:
Question #: 202
Topic #: 21
Which of the following should be done FIRST following an incident that has caused internal servers to be inaccessible, disrupting normal business operations?
A.
Document the servers ' dates, times, and locations, as well as the individual who last used them
B.
Make a bit-level copy of the affected servers and calculate the hash value of the copy.
C.
Copy all key directories and files on the affected servers and generate the hash value of the copy.
D.
Unplug all power cables immediately to prevent further actions of the attacker on the servers.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit