200-201 Question 355
Select 4A cybersecurity operations team is tasked with conducting a digital forensic investigation after a data breach. According to NIST.SP800-86, which of the following steps should be part of the forensic process in this scenario?
- A
Collection of digital evidence while maintaining its integrity
- B
Analysis of the data to identify patterns or anomalies
- C
Erasure of irrelevant data to streamline the investigation
- D
Examination of the data to extract relevant information
- E
Documentation of the investigation process and findings
Show answer and explanation
Correct answers: A, B, D, E
Explanation
NIST.SP800-86 outlines a process-oriented approach to digital forensics, which includes the steps of collection, examination, analysis, and documentation. These steps ensure that evidence is properly handled, relevant data is extracted, and the findings of the investigation are clearly documented for legal and operational purposes. Erasing data is not part of the forensic process, as it could compromise the integrity of the investigation.
- A. Correct.
Correct. NIST.SP800-86 emphasizes the importance of evidence collection while ensuring its integrity to support the investigation and maintain legal admissibility.
- B. Correct.
Correct. Analysis is a critical step in the forensic process to identify patterns, anomalies, or root causes related to the incident.
- C. Incorrect.
Incorrect. Erasure of data is not part of the forensic process. All data, even if initially deemed irrelevant, should be preserved in case it becomes important later.
- D. Correct.
Correct. Examination is a key step in which relevant information is extracted from the collected data to support the investigation.
- E. Correct.
Correct. Documentation is essential to ensure the investigation process is transparent, reproducible, and legally defensible.