SY0-701 General Security Concepts Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Identification, then Preservation, then Collection, then Examination, then Analysis, then Reporting

  Why this is correct

  This is the correct order because the forensic process begins with identifying potential evidence, then preserving it to prevent alteration, collecting it properly, examining it in detail, analyzing the results to draw conclusions, and finally reporting the findings.

• ✗

  Preservation, then Identification, then Collection, then Examination, then Analysis, then Reporting

  Why it's wrong here

  Preservation before identification is logically impossible because you cannot secure evidence you haven't yet located or defined. The identification step determines the sources and scope of potential evidence (e.g., hard drives, logs, network captures), which is a prerequisite for knowing what to preserve. Preservation involves maintaining the integrity of identified evidence through techniques like write-blocking and creating forensic images, but these actions cannot be applied until the evidence itself has been identified. Starting with preservation would also violate legal and procedural requirements that require an initial triage or survey to establish the boundaries of the investigation.

• ✗

  Identification, then Collection, then Preservation, then Examination, then Analysis, then Reporting

  Why it's wrong here

  Placing collection before preservation undermines the entire forensic integrity of the process. Preservation must occur first to protect evidence from alteration, typically by creating bit-for-bit forensic images using hardware write-blockers or hashing the original media to verify its integrity. If collection happens before preservation, the original evidence is at risk of being modified during the collection process, breaking chain of custody and potentially rendering the evidence inadmissible in court. This order violates core forensic principles such as the requirement to minimize handling of original evidence and to document every action taken from the moment evidence is identified.

• ✗

  Identification, then Preservation, then Collection, then Analysis, then Examination, then Reporting

  Why it's wrong here

  Reversing examination and analysis misrepresents the forensic workflow's logical dependency. Examination is the technical stage where hidden or deleted data is extracted, decoded, and cataloged using tools like EnCase or FTK, producing raw findings such as file metadata, deleted partitions, or unallocated space content. Analysis is the subsequent interpretive stage where those extracted findings are correlated with case context to reconstruct events, establish timelines, or prove intent. Without a thorough examination first, analysis would be baseless speculation, and this ordering error would lead investigators to jump to conclusions before all relevant technical details have been uncovered.

Go deeper

Related to this question