CISSP-ISSMP Question #181: Real Exam Question with Answer & Explanation

The correct answer is A: Acquire. The following steps are generally followed in computer forensic examinations. 1.Acquire. In this step, the examiner gets an exact duplicate copy of the original data for investigation. The examiner leaves the original copy intact. 2.Authenticate. In this step, the investigator sh

Security Operations Management

Question

Which of the following steps are generally followed in computer forensic examinations? Each correct answer represents a complete solution. Choose three.

Options

AAcquire
BAnalyze
CAuthenticate
DEncrypt

Explanation

The following steps are generally followed in computer forensic examinations. 1.Acquire. In this step, the examiner gets an exact duplicate copy of the original data for investigation. The examiner leaves the original copy intact. 2.Authenticate. In this step, the investigator shows that the data is unchanged and has not been 3.Analyze. In this step, the examiner analyzes data carefully. The examiner recovers evidence by examining hard disk drives, hidden files, swap data, the Internet cache, and the Recycle bin. Answer option D is incorrect. Encrypt is not a step followed in computer forensic examinations.

Topics

#Computer Forensics#Forensic Process#Evidence Handling#Incident Response

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSMP Practice Browse All CISSP-ISSMP Questions