Which phase focuses on protecting the crime or incident scene, preserving evidence, and documenting how it was acquired?

Enhance your cyber defense skills with the Security Blue Team Level 1 Test. Prepare with flashcards, multiple choice questions, and detailed explanations to ace your exam!

Multiple Choice

Which phase focuses on protecting the crime or incident scene, preserving evidence, and documenting how it was acquired?

Explanation:
Preservation focuses on securing the crime or incident scene, preventing alteration, and maintaining the integrity of evidence from the moment it’s identified. This phase involves restricting access, protecting the scene, and ensuring that evidence is preserved in its original state, including documenting how each item was acquired and who handled it to establish the chain of custody. By isolating devices, preventing contamination, and recording the acquisition process, investigators preserve evidentiary value for later analysis. Identification is about spotting what exists and where, collection is the act of gathering items, and analysis is about examining the evidence to draw conclusions.

Preservation focuses on securing the crime or incident scene, preventing alteration, and maintaining the integrity of evidence from the moment it’s identified. This phase involves restricting access, protecting the scene, and ensuring that evidence is preserved in its original state, including documenting how each item was acquired and who handled it to establish the chain of custody. By isolating devices, preventing contamination, and recording the acquisition process, investigators preserve evidentiary value for later analysis. Identification is about spotting what exists and where, collection is the act of gathering items, and analysis is about examining the evidence to draw conclusions.

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy