Cyber Fundamentals Block 5 Practice Exam

Gathering information at the outset is essential because it provides the facts, timeline, and context needed to understand what happened and what’s affected. Collecting logs, configurations, witness accounts, and process data early helps distinguish symptoms from the true root cause and prevents jumping to conclusions too soon. This initial data collection sets the boundaries of the investigation, preserves evidence, and informs what questions to ask during analysis. You can and should continue gathering information as needed during the analysis, but starting with information collection ensures the analysis is grounded in real data rather than assumptions. Waiting until after remediation risks losing important evidence and biases the investigation toward the fix rather than understanding the underlying cause.