A company's financial data system was breached, and investigators are now gathering and preserving digital evidence from the compromised computers and servers to understand what happened and potentially use the findings in legal proceedings. The application of investigation and analysis techniques for this purpose is called:

Question

BlackTom AI · Accepted Answer

The scenario centers on preserving and examining digital evidence from compromised systems to understand events and potentially support legal action. This aligns with computer forensics, which involves the systematic collection, preservation, analysis, and presentation of digital evidence.
Option 1: Computer forensics. This choice matches the described purpose of gathering and preserving digital evidence for potential use in legal proceedings, focusing on proper evidence handling and analysis.
Option 2: Disaster recovery. While important for restoring normal operations after a failure or breach, disaster recovery concentrates on resuming business functions and availability, not on evidentiary collection and legal admissibility.
Option 3: Incident response. This discipline covers the immediate actions taken to detect, contain, eradicate, and recover from a security incident. It addresses containment and remediation rather than the forensic analysis and legal presentation of evidence, though it may precede forensic work.
Option 4: Intrusion detection. This refers to identifying unauthorized access or suspicious activity, typically through monitoring systems. It’s about detection, not the broader process of evidentiary gathering and analysis for proceedings.
In summary, the description most closely corresponds to computer forensics because it emphasizes preserving and analyzing digital evidence for potential legal use, whereas the other options describe related but distinct phases or goals of cybersecurity and IT resilience.

查看解析

登录即可查看完整答案

类似问题

Which of the following is a crucial step in the digital forensic investigation methodology?

A digital forensic investigator is examining a computer system suspected to contain evidence of unauthorized access. In this context, which principle is critical for the investigator to adhere to during the investigation?

What is a primary responsibility of a Digital Evidence First Responder (DEFR)?

How can the principle of reliability be ensured in digital evidence handling?

What is the correct procedure if a device at an incident site is found to be powered ON?

What is the purpose of auditing and justifying the procedures followed in digital evidence acquisition?

What are the options available to the DEFR for acquiring potential digital evidence from CCTV systems?

What should the DEFR do before disconnecting a networked device from the network?

更多留学生实用工具

考试浏览器助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单