Which term describes the activity of collecting and examining data to determine how a security incident occurred?

• A. Forensic investigation
• B. Hacker
• C. Frame Relay
• D. GBIC Transceiver

Answer: (A)

In cybersecurity, understanding how a security incident happened hinges on performing a forensic investigation. This means systematically collecting evidence from digital sources—logs, disk images, memory dumps, network captures, and other artifacts—and then examining that data to reconstruct the sequence of events. The goal is to determine the attack vector, methods used, affected systems, timeframe, and how access was gained, so defenses can be strengthened and lessons learned for future prevention. It also involves preserving evidence in a way that maintains its integrity, often described as chain of custody, so findings can support post-incident actions or legal needs.

The other options don’t fit the activity described. An attacker (a hacker) is the person who carried out the incident, not the process of examining what happened. Frame Relay is a networking technology, a WAN protocol, unrelated to investigating an incident. A GBIC transceiver is a hardware component used for fiber optic or copper connections, not an investigative process.