You are the team lead for the corporate incident response team. During the containment phase of the response, you view evidence that indicates a crime has been committed. Which of the following is your best course of action?

🎲 Try a Random Question | Total Questions in Quiz: 17 | 🧠 Study this quiz with Flashcards

This question is part of a full practice quiz:

CompTIA CySA+ Cybersecurity Analyst Certification Exam: Incident Response — practice the complete quiz, review flashcards, or try a random question.

🧠 Flashcards (fast review) 🧪 Practice Quiz ⚔️ Challenge a Friend 🥊

You are the team lead for the corporate incident response team. During the containment phase of the response, you view evidence that indicates a crime has been committed. Which of the following is your best course of action?

Initiate an investigation into potential criminal acts, collect evidence, and forensically analyze it for potential presentation to law enforcement.
Preserve the evidence and relay your concerns to the legal department so they can decide about whether to contact law enforcement.
Immediately call law enforcement personnel, provide them with the evidence, and allow them to start an investigation.
Do not notify anyone about your suspicions, as you are not legally qualified to determine if a crime has been committed—this could be a false alarm.2

You are the team lead for the corporate incident response team. During the containment phase of the response, you view evidence that indicates a crime has been committed. Which of the following is your best course of action?

❤ If you liked Fatskills, consider supporting us by checking out The Life Manuals You Never Got.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | What Should We Know?
Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson
© 2026 Fatskills.com

All trademarks, logos and brand names are the property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement.

You are the team lead for the corporate incident response team. During the containment phase of the response, you view evidence that indicates a crime has been committed. Which of the following is your best course of action?

❤ If you liked Fatskills, consider supporting us by checking out The Life Manuals You Never Got.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | What Should We Know? Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson© 2026 Fatskills.com

All trademarks, logos and brand names are the property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, trademarks and brands does not imply endorsement.

About | Explore | User Guide | Topics | Subjects | Doubt Solver | Career Aptitude Test | Answers | Free Tools | What Should We Know?
Privacy | Terms |

Without work one finishes nothing. - Ralph Waldo Emerson
© 2026 Fatskills.com