A technician is called to investigate a potential data breach involving client PII. The technician has identified the affected systems and has taken screenshots of the current state. According to proper incident response procedures, what should the technician do NEXT?

Wipe the affected systems to remove any malware.

Wiping would destroy all evidence, making forensic analysis impossible. Evidence preservation is a higher priority than immediate remediation.

Notify the relevant authorities immediately.

While authorities may need to be notified, the immediate priority is to preserve evidence. Notification usually happens after internal escalation and forensic imaging.

Reinstall the operating system from scratch.

Reinstalling the OS would overwrite data and destroy evidence. Remediation steps like reinstallation come after evidence has been preserved and analyzed.

What does this 220-1102 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Preserve the evidence by creating forensic images of the hard drives. — In incident response, the preservation of evidence is critical for forensic analysis and potential legal proceedings. After identifying the affected systems and documenting the current state with screenshots, the next step is to create forensic images of the hard drives to preserve the data in a forensically sound manner. This prevents evidence from being altered or destroyed. Option C is correct. Option A (wiping) and Option D (reinstalling OS) would destroy evidence and are incorrect. Option B (notifying authorities) may be necessary but typically occurs after internal escalation and preservation of evidence, not as the immediate next step.

What should I do if I get this 220-1102 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.