Certbie
Question 1 of 30
A digital forensics investigator is examining a series of log files from a compromised server. Their initial hypothesis, based on the first few entries, suggests a specific type of malware infection. However, as they progress through the logs, they discover entries that appear to contradict this initial assessment, indicating a different attack vector or a sophisticated evasion technique. According to the principles of ISO/IEC 27042, what is the most appropriate immediate course of action for the investigator?
Document the conflicting evidence, revise the analytical approach to investigate the new findings, and continue the analysis to reconcile or explain the discrepancies.
Disregard the conflicting entries as potential anomalies or system errors and proceed with the original hypothesis to maintain analytical efficiency.
Halt the analysis immediately and request a new forensic image of the server, assuming the current evidence is fundamentally unreliable.
Focus solely on the evidence that supports the initial hypothesis and exclude any data that deviates from it to strengthen the original conclusion.

Preparing for ISO/IEC 27042:2015 - Analysis and Interpretation of Digital Evidence Professional? Now land the interview.

73% of qualified candidates get rejected because of weak resumes. Build an ATS-optimized, recruiter-ready resume in under 5 minutes - free to start.

Build My Resume Free