CompTIA A+ Core 2 (220-1102) — Question 47

An incident handler needs to preserve evidence for possible litigation. Which of the following will the incident handler MOST likely do to preserve the evidence?

Answer options

• A. Encrypt the files.
• B. Clone any impacted hard drives.
• C. Contact the cyber insurance company.
• D. Inform law enforcement.

Correct answer: B

Explanation

Cloning any impacted hard drives ensures that the original data remains intact and unaltered, which is crucial for preserving evidence in legal contexts. While encrypting files may protect them, it does not preserve the original state of the evidence. Contacting the cyber insurance company or informing law enforcement may be necessary steps, but they do not directly relate to the preservation of evidence.