Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) — Question 307

During which phase of the forensic process is data that is related to a specific event labeled and recorded to preserve its integrity?

Answer options

• A. examination
• B. investigation
• C. collection
• D. reporting

Correct answer: C

Explanation

The correct answer is C, collection, as this phase involves gathering and labeling data to ensure it remains intact for analysis. Options A, B, and D refer to different phases where analysis, inquiry, and documentation occur, but do not specifically focus on the preservation of data integrity during the initial gathering process.