is the primary purpose of a forensic investigation during the analysis phase of an incident response?

Question

Options

• ATo update the risk registry and minimize the impact of an incident
• BTo collect evidence and maintain its chain of custody for potential legal proceedings
• CTo identify the attacker and their motivation
• DTo document lessons learned and develop an incident response plan

• A
  7% (2)
• B
  89% (24)
• C
  4% (1)

Explanation

During the analysis phase of incident response, forensic investigation focuses on collecting digital evidence in a legally sound manner and maintaining a documented chain of custody. This ensures the evidence is admissible if legal proceedings follow. Updating the risk registry (A) is a risk management task done post-incident. Identifying the attacker's motivation (C) may be a secondary outcome but is not the primary forensic purpose. Documenting lessons learned (D) occurs during the post-incident review phase, not the analysis phase.

No community discussion yet for this question.