CompTIA CySA+ CS0-001 – Question010

A security analyst received a compromised workstation. The workstations hard drive may contain evidence of criminal activities. Which of the following is the FIRST thing the analyst
must do to ensure the integrity of the hard drive while performing the analysis?

Make a copy of the hard drive.
B. Use write blockers.
C. Run rm R command to create a hash.
D. Install it on a different machine and explore the content.

Section: CompTIA Cybersecurity Analyst (CySA+) – Questions and answers

Correct Answer: B