Memory injection vulnerabilities allow unauthorized code or commands to be executed within a software program, leading to abnormal behavior such as generating outbound traffic over random high ports. This issue often arises from software not properly validating or encoding input, which can be exploited by attackers to inject malicious code.References: CompTIA Security+ SY0-701 course content and official CompTIA study resources.

Jailbreaking is the process of removing the restrictions imposed by the manufacturer or carrier on a mobile device, such as an iPhone or iPad. Jailbreaking allows users to install unauthorized applications, modify system settings, and access root privileges. However, jailbreaking also exposes the device to potential security risks, such as malware, spyware, unauthorized access, data loss, and voided warranty. Therefore, an organization may prohibit employees from jailbreaking their mobile devices to prevent these vulnerabilities and protect the corporate data and network. References: CompTIA Security+ Study Guide: Exam SY0-701,
9th Edition, Chapter 10: Mobile Device Security, page 507 2

The correct answer is C. Agree on data classification labels with stakeholders.
Before moving proprietary company data to a public cloud storage service, the organization must first determine how the data should be classified. Data classification identifies the sensitivity, ownership, regulatory requirements, and handling requirements of the data. Examples of classification labels may include public, internal, confidential, restricted, private, regulated, or proprietary.
This aligns with CompTIA Security+ SY0-701 concepts related to protecting data, cloud security considerations, and governance. A security engineer cannot properly evaluate cloud risks, encryption needs, access controls, retention rules, compliance requirements, or contractual protections until the organization agrees on what type of data is being moved and how sensitive it is.
Why the other options are incorrect:
A). Create an architecture diagram of cloud storage solutions.
This is useful later, but it should not be the first step. The architecture depends on the data classification and security requirements.
B). Migrate sample data to the cloud to run security tests.
This is premature and risky. Data should not be moved to the cloud before classification, risk analysis, access control requirements, and compliance requirements are understood.
D). Make a backup of the data on cloud-neutral storage.
Backups are important, but they do not address the first security concern: understanding the sensitivity and handling requirements of the proprietary data.
Therefore, the best first action is to agree on data classification labels with stakeholders.

To efficiently identify where data was exfiltrated from and where it was sent, the best action is to analyze firewall and network logs for unusually large outbound data transfers. Security+ SY0-701 emphasizes that network-level telemetry provides the most direct evidence of data exfiltration, including source IPs, destination IPs or domains, ports, protocols, timestamps, and data volume.
Firewall and flow logs can quickly reveal which internal systems transmitted large quantities of data externally and identify the attacker's destination infrastructure. This approach is efficient because it focuses directly on the movement of data rather than preliminary or secondary indicators.
IPS/IDS logs (B) are more useful for detecting reconnaissance or intrusion attempts, not confirming data theft paths. Endpoint and application logs (C) may help identify tools used but are less efficient for mapping data movement. External vulnerability scans (D) identify weaknesses, not exfiltration activity.
Therefore, the most efficient action is A: Analyze firewall and network logs for large outbound traffic.

The best answer is C. Chain of custody.
Chain of custody is the documented process used to track forensic evidence from the moment it is collected until it is presented, stored, transferred, or disposed of. It records:
who handled the evidence
when it was handled
where it was stored
how it was transferred
how its integrity was preserved
This is critical to ensure the evidence remains credible and admissible.
Why the other options are incorrect:
A). Acquisition of evidenceAcquisition refers to collecting or imaging evidence, but it does not specifically cover the full documentation of handling over time.
B). E-discoveryE-discovery relates to identifying and producing electronically stored information for legal matters, not specifically preserving forensic handling records.
D). Forensic tabletop exercisesThese are discussion-based practice activities, not evidence handling procedures.
From a Security+ perspective, preserving and documenting forensic evidence handling is the definition of chain of custody.