Which activity is used to analyze cybersecurity incidents after they occur?

Which activity is used to analyze cybersecurity incidents after they occur?

• A. Sniff Test
• B. Access Control
• C. Iris Recognition
• D. Forensics Analysis

Answer: (D)

Digital forensics is the process used to analyze cybersecurity incidents after they occur. It involves collecting, preserving, and examining digital evidence from affected systems and networks to understand what happened, how it happened, and what was impacted. The goal is to reconstruct the attack timeline, identify the attacker’s methods and tools, determine the scope of the breach, and support containment, remediation, and any legal or regulatory actions. This work relies on artifacts like disk images, memory dumps, log files, network captures, and malware samples, all handled with a documented chain of custody to keep evidence reliable. Understanding these findings helps improve defenses and prevents recurrence by guiding updates to incident response plans and security controls. Other options don’t fit as well because sniffing typically relates to capturing and analyzing network traffic, access control focuses on who can access resources, and iris recognition is a biometric authentication method, not the post-incident analysis process.

Digital forensics is the process used to analyze cybersecurity incidents after they occur. It involves collecting, preserving, and examining digital evidence from affected systems and networks to understand what happened, how it happened, and what was impacted. The goal is to reconstruct the attack timeline, identify the attacker’s methods and tools, determine the scope of the breach, and support containment, remediation, and any legal or regulatory actions. This work relies on artifacts like disk images, memory dumps, log files, network captures, and malware samples, all handled with a documented chain of custody to keep evidence reliable. Understanding these findings helps improve defenses and prevents recurrence by guiding updates to incident response plans and security controls. Other options don’t fit as well because sniffing typically relates to capturing and analyzing network traffic, access control focuses on who can access resources, and iris recognition is a biometric authentication method, not the post-incident analysis process.