Symantec Data Loss Prevention (DLP) Practice Test

Evidence collection in the DLP incident lifecycle centers on gathering and preserving artifacts that let investigators understand what happened, decide how to remediate, and demonstrate compliance during audits. This means capturing relevant data such as policy hits, user and system activity, data movement logs, involved emails or documents, and any supporting screens or screenshots, while maintaining a clear chain of custody with time stamps and source details. The goal is to keep data intact and verifiable so actions taken during investigation and remediation are credible and defensible for audits and regulatory reviews. It isn’t about closing the case with no audit trail, reassigning ownership, or deleting data—those would undermine investigation integrity and accountability.