Eccouncil 212-89 Exam - Topic 10 Question 98 Discussion

Actual exam question for Eccouncil's 212-89 exam

Question #: 98
Topic #: 10

Bob, an incident responder at CyberTech Solutions, is investigating a cybercrime attack occurred in the client company. He acquired the evidence data, preserved it, and started

performing analysis on acquired evidentiary data to identify the source of the crime and the culprit behind the incident.

Identify the forensic investigation phase in which Bob is currently in.

AVulnerability assessment phase

BPost-investigation phase

CPre-investigation phase

DInvestigation phase

Show Suggested Answer

Suggested Answer: D

Bob is in the Investigation phase of the forensic investigation process. This phase involves the detailed examination and analysis of the collected evidence to identify the source of the crime and the perpetrator behind the incident. It is a crucial step that follows the acquisition and preservation of evidence, where the incident responder applies various techniques and methodologies to analyze the evidentiary data. This analysis aims to uncover how the cybercrime was committed, trace the activities of the culprit, and gather actionable intelligence to support legal actions and prevent future incidents.

by Dominga at Jun 30, 2026, 11:44 AM

Limited Time Offer

25%

1 month ago

I think Bob is in the Investigation phase since he's analyzing the evidence data. That seems to fit with what we practiced.

upvoted 0 times

...