A security analyst suspects that a workstation is infected with a kernel-level rootkit. The workstation is currently running and the analyst needs to preserve evidence for forensic analysis. Which of the following actions should the analyst take FIRST?

Disconnect the workstation from the network

Disconnecting from the network is important to prevent further damage or data exfiltration, but preserving the forensic image first ensures that volatile evidence (e.g., memory contents, running processes) is captured before any network disconnection might alter the system state.

Run a rootkit removal tool

Running a removal tool would modify the system and destroy forensic evidence. The goal of incident response is to first preserve evidence before taking remediation actions.

Power off the workstation

Powering off can cause loss of volatile data (memory, network connections) and may damage evidence. Some rootkits are memory-resident; a clean shutdown may trigger anti-forensic measures.

What does this 220-1101 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create a forensic image of the hard drive — The first step in forensic preservation is to create a bit-for-bit forensic image of the hard drive while the system is running, before any changes occur. This captures the state of the rootkit in memory and on disk. Disconnecting from the network is important but should be done after the image is taken to avoid losing volatile data. Running a removal tool would alter evidence. Powering off may cause loss of volatile data (memory) and can lead to data corruption.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.