Question

A security manager has discovered that sensitive information stored on a server has been compromised. The organization is required by law to notify law enforcement. What should the security manager do first to preserve non-volatile evidence on the server

Answer 1

Answer: disconnect power to the server.

Step-by-step explanation:

So as to avoid further damage and also to preserve evidence of the server compromise, the server needs to be disconnected completely from the power source.