Examkin

Question

Difficulty: MediumIncident Response and Chain of Custody

During a routine physical security audit of a remote branch office, a systems administrator discovers an unauthorized hardware keylogger connected between a workstation keyboard and the computer tower. To adhere to proper incident response and evidence preservation procedures, which of the following actions should the administrator take FIRST?

  1. A
    Inspect the keylogger's internal storage on a technician workstation to identify captured credentials.
  2. Photograph the device in place and document its physical configuration before reporting the incident.Answer
  3. C
    Immediately disconnect the power cable from the workstation tower to interrupt hardware logging.
  4. D
    Remove the keylogger and store it in an unsealed desk drawer until the forensic investigator arrives.

Answer

Photograph the device in place and document its physical configuration before reporting the incident.
Photographing the keylogger in place and recording its exact physical configuration preserves evidence context before physical removal. This action fulfills first-responder requirements for evidence preservation under CompTIA incident response standards.

Step-by-Step Solution

1
Identify the security incident and secure the physical area without altering potential evidence.
The physical scene remains undisturbed.
First responders must avoid altering physical or digital evidence states before documentation occurs.
2
Photograph the device in place and record all physical connections and environmental details.
Documentary and visual proof of the original evidence configuration is established.
Photographic evidence proves the original state of the device prior to removal or transport.
3
Report the incident to designated security personnel and initiate chain of custody logs.
Proper escalation takes place with documented custody tracking.
Escalation ensures qualified forensic analysts take possession of evidence under unbroken chain of custody.

Key Concept

First Responder Evidence Preservation and Initial Response Sequence
Rate this question

Topics

Incident Response and Chain of Custody

More questions from this topic