Question

What is an example of an action that would most likely be taken in the first phase of a forensic investigation?

(1 point)

reviewing SIEM log files


extracting data from an encrypted file


looking for compromised accounts


checking for patterns in criminal activity

Answer 1

reviewing SIEM log files

Reason: the first phase is identification/triage — reviewing logs is a common initial step to detect and scope an incident before collection, preservation, or deep analysis.