Why should evidence be captured before rebuilding a compromised host?
- A Rebuilding destroys the ability to determine how the attacker got in
- B It is required for insurance only
- C It speeds up recovery
- D It prevents reinfection automatically
Answer
Rebuilding destroys the ability to determine how the attacker got in
If you do not know the entry point you have not eradicated anything, and the attacker will simply return the same way.





