nerdexam
GIAC

GCFA · Question #60

Which of the following is the correct order of digital investigations Standard Operating Procedure(SOP)?

The correct answer is D. Request for service, initial analysis, data collection, data analysis, data reporting. The correct digital forensics SOP begins with a formal service request, proceeds through scoping and evidence acquisition, and concludes with analysis before reporting.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Which of the following is the correct order of digital investigations Standard Operating Procedure(SOP)?

Options

  • AInitial analysis, request for service, data collection, data analysis, data reporting
  • BInitial analysis, request for service, data collection, data reporting, data analysis
  • CRequest for service, initial analysis, data collection, data reporting, data analysis
  • DRequest for service, initial analysis, data collection, data analysis, data reporting

How the community answered

(26 responses)
  • A
    12% (3)
  • B
    4% (1)
  • C
    4% (1)
  • D
    81% (21)

Why each option

The correct digital forensics SOP begins with a formal service request, proceeds through scoping and evidence acquisition, and concludes with analysis before reporting.

AInitial analysis, request for service, data collection, data analysis, data reporting

This option incorrectly places initial analysis before the formal request for service and transposes data analysis and data reporting, which is procedurally invalid since findings cannot be reported before analysis is complete.

BInitial analysis, request for service, data collection, data reporting, data analysis

This option also places initial analysis before the service request and puts data reporting before data analysis, which is illogical because a report cannot be generated prior to analyzing the collected evidence.

CRequest for service, initial analysis, data collection, data reporting, data analysis

This option correctly sequences the first three steps but then places data reporting before data analysis, reversing the final two phases and producing findings before the evidence has been examined.

DRequest for service, initial analysis, data collection, data analysis, data reportingCorrect

The correct SOP sequence is: Request for service (formally initiating and authorizing the investigation), initial analysis (scoping and planning the approach), data collection (acquiring and preserving evidence with chain of custody), data analysis (examining and interpreting collected evidence), and data reporting (documenting and presenting findings) - this order ensures evidentiary integrity and produces a defensible forensic process.

Concept tested: Digital forensics investigation SOP sequence

Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-86.pdf

Topics

#digital investigation SOP#forensic procedure#investigation workflow#incident response process

Community Discussion

No community discussion yet for this question.

Full GCFA Practice