GIAC Certified Forensic Analyst (GCFA) — Question 44

Which of the following representatives of incident response team takes forensic backups of the systems that are the focus of the incident?

Answer options

• A. Technical representative
• B. Information security representative
• C. Legal representative
• D. Lead investigator

Correct answer: A

Explanation

The Technical representative is tasked with taking forensic backups as they possess the necessary skills and tools for the technical aspects of incident response. The Information security representative focuses on security policies, the Legal representative deals with compliance and legal aspects, and the Lead investigator coordinates the investigation rather than performing technical tasks directly.