TestOut LabSim A+ Certification Practice Exam

What is the first step to take when conducting a forensic investigation after an attack has been stopped?

1. Disconnect from the network

2. Document what's on the screen

3. Run a virus scan

4. Repair the affected systems

The correct answer is: Document what's on the screen

The first step in a forensic investigation after an attack has been stopped is to document what is on the screen. This step is crucial because capturing the current state of the system provides valuable evidence that may be critical for understanding the nature of the attack. Documenting includes taking screenshots or notes of system displays, running processes, or any other relevant data that can offer insights into the attack, such as unusual login attempts, error messages, or newly created files. This documentation serves multiple purposes—it helps preserve the context in which the attack occurred and ensures that important evidence is not lost if the system is altered or rebooted. Furthermore, it establishes a record that can be used for further investigation, legal action, or lessons learned to improve security measures in the future. While disconnecting from the network might prevent further damage, it could also result in the loss of volatile data, which is why documenting what’s on the screen takes precedence. Similarly, running a virus scan or repairing systems comes afterward, as these actions could alter the state of the system and risk destroying forensic evidence.