Which term should an analyst select when the task is to examine forensic evidence during an incident investigation during initial triage?

Question

Accepted Answer

B. Forensics. Forensics is correct because the official Palo Alto Networks XDR Analyst datasheet maps it to forensics. That makes it the best fit when the analyst needs to examine forensic evidence during an incident investigation during initial triage. Investigation lifecycle is not correct because it addresses a different requirement within Incident Handling and Response.

Which term should an analyst select when the task is to examine forensic evidence during an incident investigation during initial triage?

Related Questions

Discussion