Security Policies and Procedures →hardMultiple ChoiceObjective-mapped

200-201 Security Policies and Procedures Practice Question

During the containment phase of an incident, the IR team decides to power off a compromised server to prevent further damage. However, they later realize that this action may have destroyed volatile evidence. According to best practices, what should the team have done instead?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Perform a live forensic image of the server's memory before powering off

Short-term containment should preserve evidence; live imaging captures volatile data before power-off.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Disconnect the server from the network but leave it running
Why it's wrong here
While better than power-off, volatile data may still be lost if the system is shut down later.
✓
Perform a live forensic image of the server's memory before powering off
Why this is correct
Live imaging captures volatile data such as memory and running processes.
✗
Immediately power off the server without any imaging
Why it's wrong here
This loses volatile evidence.
✗
Skip evidence collection and focus solely on containment
Why it's wrong here
Evidence collection is critical for investigation and legal proceedings.

Go deeper

200-201 Security Policies and Procedures Practice Question

Why each option matters

Option-by-option breakdown

Related to this question