CompTIA Network+ (N10-007) — Question 120

A forensic first responder arrives at the scene where an employee is suspected to have committed a computer-based crime. Which of the following should the first responder do FIRST?

Answer options

• A. Document the scene
• B. Take pictures upon arrival
• C. Secure the area
• D. Implement chain of custody

Correct answer: C

Explanation

The first responder should prioritize securing the area to prevent evidence tampering or loss. Documenting the scene and taking pictures are important but should follow the securing of the area. Implementing chain of custody is critical but occurs later in the process after securing the evidence.