GIAC Exam GCED Topic 6 Question 42 Discussion

Actual exam question for GIAC's GCED exam

Question #: 42
Topic #: 6

[All GCED Questions]

When attempting to collect data from a suspected system compromise, which of the following should generally be collected first?

AThe network connections and open ports

BThe contents of physical memory

CThe current routing table

DA list of the running services

Show Suggested Answer

Suggested Answer: A

by Lemuel at Jun 21, 2024, 12:30 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

18 days ago

Definitely B) The contents of physical memory. That's the first thing I learned in my incident response training.

upvoted 0 times

3 days ago

A) The network connections and open ports

upvoted 0 times

...

22 days ago

I agree with Owen, capturing the contents of physical memory can provide valuable insights into the compromise.

upvoted 0 times

...

23 days ago

I disagree, I believe B) The contents of physical memory is more crucial in a suspected system compromise.

upvoted 0 times

...

24 days ago

I think A) The network connections and open ports should be collected first.

upvoted 0 times

...