Study. uk . com
  1. Home
  2. All questions
  3. Question 530

CompTIA Security+ study material · question 530 of 611

How do the questions asked by an incident responder and a forensic examiner differ?

  1. The responder works only after the examiner finishes
  2. The responder asks what provably happened; the examiner asks how to stop it
  3. The responder asks how to stop it; the examiner asks what provably happened
  4. Both ask the same question at different times
Show the answer

Answer: C. The responder asks how to stop it; the examiner asks what provably happened

The disciplines overlap in evidence but differ in purpose, which is why speed and rigour pull against each other.

Source: NIST SP 800-86 (NIST) — SP 800-86 § 2 Establishing and Organizing a Forensics Capability

Challenge yourself on this topic → Study as cards