CompTIA · CySA+ CS0-004
Evidence, containment, and recovery
CySA+ CS0-004 · Lesson 20 of 22 · 2:50:43
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: chain of custody, data integrity validation with hashes, preservation and the order of volatility, legal hold, isolating affected targets, escalation, remediation and verification, release from isolation, restoration, root cause analysis, and corrective actions. Includes three original practice questions.
Preview the topics
- An analyst copies the disk of the teller laptop, computes a SHA-256 hash of the image, and computes it again before each analysis, to show that the image never changed. Which evidence practice is this?
- The loader has been removed from the teller laptop, and the teller’s password has been reset. Before reconnecting the laptop to the network, what should the team do?
- After the incident, the team finds that the loader ran because macros from the internet were allowed on teller laptops. It assigns an owner and a due date to block them by policy. Which step is this?