David, a digital forensics examiner, is investigating a cybercrime incident for a multinational corporation.

The correct answer is C because ISO/IEC 27043 is the standard most closely associated with organizational digital investigation readiness, incident investigation principles, and the processes needed to build and improve a digital forensic capability. In the CHFI v11 blueprint, standards and best practices are tested alongside practical forensic readiness, investigation process discipline, and evidence management. That makes ISO/IEC 27043 the strongest fit when the question asks about establishing, maintaining, and improving forensic capability at the organizational level. The other options each cover narrower functions. ISO/IEC 27037 focuses on identification, collection, acquisition, and preservation of digital evidence. ISO/IEC 27042 is centered on analysis and interpretation of digital evidence. ISO/IEC 27041 deals with assuring the suitability and adequacy of incident investigative methods. Those are all important, but they do not describe the broader organizational investigation framework as well as ISO/IEC 27043 does. For CHFI exam logic, this is a scope question: when the wording points to enterprise-level forensic capability and ongoing improvement rather than a single handling stage, ISO/IEC 27043 is the best verified choice.