Domain 4 · Objective reference 4B2 · Chapter 31 of 35
Investigate and evaluate incident evidence
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Preserve first and document every handoff.
Explore the anchors
Protect evidence against alteration.
Concept matching activity
Match this task or description to its concept:
Test hypotheses using corroborated facts.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Establish a shared picture
Management concept and decision mechanism
Investigation should distinguish facts, hypotheses and confidence while identifying scope, access path, impact and ongoing activity. Collect relevant records with source, time, method and handler, preserving integrity and custody appropriate to the purpose. A hash helps detect alteration but does not establish that the original observation was accurate or lawfully collected. Coordinate legal, regulatory, personnel and technical requirements through authorized owners. Avoid collecting unrelated information. Investigation may continue while urgent containment proceeds; there is no universal rule to complete every forensic step before limiting active harm.
Establish a shared picture
Triage an alert using the available evidence, affected services, and potential consequences. Record what is known, what remains uncertain, and which actions are underway. Severity may change as the investigation reveals scope or business impact.
Assign an incident coordinator and engage the appropriate technical and business owners. Define a common record of decisions and a cadence for updates. Avoid fragmented instructions from several leaders that leave responders unsure which action is authorized.
Worked example
An investigator correlates account activity, host evidence and change records before deciding whether an unexplained task is malicious persistence.
Check your understanding
What remains missing when a file hash is recorded without collection details?
Show explanation
Provenance and handling: where the artifact came from, how and when it was collected and who controlled it.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.