Describe a typical process for evidence triage during a multi-host incident.

• A. Identify scope, prioritize critical hosts, collect volatile data promptly, preserve evidence with chain-of-custody, and coordinate with stakeholders.
• B. Randomly collect data from all hosts without priority.
• C. Focus only on network devices.
• D. Wait for legal approval before collecting anything.

Answer: (A)

In an incident that spans multiple hosts, the key is to triage quickly to understand scope and focus on data that will tell you what happened while it’s still recoverable. Begin by scoping the incident so you know which systems are affected, what assets are critical, and what your objectives are. Then prioritize critical hosts—the machines most likely to hold time-sensitive, volatile evidence (RAM contents, active processes, open network connections, recent log events, and running malware). Collect this volatile data promptly before it’s lost due to power changes or further compromise, and do so in a way that preserves evidence integrity.

Preserving the data with solid chain-of-custody ensures you can later validate and share findings with stakeholders, investigators, and legal teams. Coordinating with stakeholders keeps the response aligned on scope, data handling requirements, permissible actions, and reporting expectations, which helps prevent missteps or duplicate effort across teams.

This approach beats random data collection, which wastes time and may miss critical volatile artifacts; it also avoids focusing only on network devices, which misses host-based evidence; and it prevents delaying collection while waiting for approvals, which risks losing volatile data and delaying containment and remediation.