Certified Network Defender (CND) — Question 101
Which of the following representatives of the incident response team takes forensic backups of systems that are the focus of an incident?
Answer options
- A. Technical representative
- B. Lead investigator
- C. Information security representative
- D. Legal representative
Correct answer: A
Explanation
The Technical representative is tasked with collecting and preserving forensic evidence, including backups of systems affected by the incident. The Lead investigator focuses on analysis and coordination, the Information security representative deals with policy and security measures, and the Legal representative ensures compliance with laws and regulations, but none of them perform the actual backup duties.