CISSP Question #470: Real Exam Question with Answer & Explanation

The correct answer is B: search for relevant strings.. Searching for relevant strings is one of the steps performed during the forensic data analysis phase. Strings are sequences of printable characters that may contain useful information, such as passwords, usernames, email addresses, file names, and commands. Searching for strings

Submitted by daniela_cl· Mar 5, 2026Security Operations

Question

Which of the following steps is performed during the forensic data analysis phase?

Options

ACollect known system files
Bsearch for relevant strings.
CCreate file lists
DRecover deleted data.

Explanation

Searching for relevant strings is one of the steps performed during the forensic data analysis phase. Strings are sequences of printable characters that may contain useful information, such as passwords, usernames, email addresses, file names, and commands. Searching for strings can help to identify and extract evidence from the data collected during the forensic acquisition phase. Collecting known system files, creating file lists, and recovering deleted data are steps performed during the forensic acquisition phase, not the forensic data analysis phase. The forensic acquisition phase involves creating a bit-by-bit copy of the original data source, verifying its integrity, and preserving its chain of custody. The forensic data analysis phase involves examining and interpreting the data to find relevant facts and artifacts that support the

Topics

#digital forensics#forensic analysis#incident response#evidence analysis

Community Discussion

No community discussion yet for this question.

Full CISSP Practice Browse All CISSP Questions