[&] What is a recommended approach for the storage and deployment of an incident response toolkit?
- Store tools only on local hard drives for security
- Utilize commando VM for all toolkit deployments
- Maintain usable copies in multiple locations for accessibility -- Correct
- Keep all tools on a single cloud server for centralized management

[&] In terms of organization, how should an incident response toolkit be structured?
- Tools sorted by the developer's name
- Alphabetical order for easy lookup
- Based on the acquisition cost of each tool
- Tools structured by their purpose within the response process -- Correct

[&] Which of the following is NOT a tool typically found in an evidence collection and imaging category?
- DD
- FTK Imager
- Autopsy -- Correct
- Magnet RAM Capture