CompTIA CySA+ (CS0-003) — Question 507

When starting an investigation, which of the following must be done first?

Answer options

• A. Notify law enforcement
• B. Secure the scene
• C. Seize all related evidence
• D. Interview the witnesses

Correct answer: B

Explanation

The correct answer is B, as securing the scene is essential to preserve evidence and maintain the integrity of the investigation. Options A, C, and D are important steps but should only be undertaken after the scene has been secured to prevent contamination or loss of evidence.