問題文
A security team reports that an administrative account of the backup platform may have been used by an intruder. Before any restore is attempted, why does the runbook ask the team to suspend the expiry of existing copies and to preserve the records?
選択肢
- Ordinary operation keeps compressing copies as they age, so the evidence and the last clean point are becoming harder to read while the team investigates the incident.
- Ordinary operation keeps deleting copies as their retention runs out, so the evidence and the last clean point are being destroyed on schedule while the team investigates.
- Ordinary operation keeps replicating copies to the second site, so the evidence and the last clean point are being spread further while the team investigates.
- Ordinary operation keeps reindexing copies for search, so the evidence and the last clean point are being renumbered while the team investigates.