The choices can be found elsewhere and as follows: a. perform an immediate full backup b. attempt to end the process c. pull the power cable d. record the destruction using a video capture of the screen
I think the correct answer is option a. If a destructive program is running that might be destroying evidence, then perform an immediate full backup.
