An IT technician discovers a corporate workstation actively communicating with a known malicious command-and-control server on the internet. To follow proper CompTIA incident response guidelines and preserve evidence integrity, in what order should the technician execute the following actions?
- 1Report the security incident immediately to the designated incident response team and management.
- 2Isolate the workstation from the network by disconnecting the network cable and disabling Wi-Fi.
- 3Capture the volatile system memory (RAM) while the machine remains powered on.
- 4Fill out a chain of custody log and place the seized physical storage drive into a tamper-evident anti-static bag.
Answer
The correct order of incident response and evidence preservation steps is: 1) Report the security incident immediately to the designated incident response team and management, 2) Isolate the workstation from the network by disconnecting the network cable and disabling Wi-Fi, 3) Capture the volatile system memory (RAM) while the machine remains powered on, and 4) Fill out a chain of custody log and place the seized physical storage drive into a tamper-evident anti-static bag.
Standard operational procedures specify that security incidents must first be reported to proper authorities. Next, the technician must isolate the compromised system from the network to stop active communication without powering down the machine. Once isolated, volatile memory (RAM) must be collected before system state changes. Finally, chain of custody logs are filled out as physical evidence is packaged and handed off.
Step-by-Step Solution
Key Concept
Incident Response Life Cycle and Order of Volatility in Evidence Handling