exam questions

Exam CISSP All Questions

View all questions & answers for the CISSP exam

Exam CISSP topic 1 question 256 discussion

Actual exam question from ISC's CISSP
Question #: 256
Topic #: 1
[All CISSP Questions]

What is the MOST important criterion that needs to be adhered to during the data collection process of an active investigation?

  • A. Maintaining the chain of custody
  • B. Capturing an image of the system
  • C. Outlining all actions taken during the investigation
  • D. Complying with the organization's security policy
Show Suggested Answer Hide Answer
Suggested Answer: A 🗳️

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
DJOEK
8 months ago
Selected Answer: A
Maintaining the chain of custody is the most important criterion that needs to be adhered to during the data collection process of an active investigation according to cissp. The chain of custody is the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. This includes information such as who collected the data, when it was collected, how it was collected, and where it was stored.
upvoted 1 times
jackdryan
3 months, 4 weeks ago
A is correct
upvoted 1 times
...
...
oudmaster
8 months, 2 weeks ago
Given answer is correct. Note that word "criterion" which means a standard. Otherwise option D will be the correct answer.
upvoted 2 times
...
rdy4u
10 months, 2 weeks ago
Selected Answer: A
When collecting and handling evidence during an investigation, it is important to create an accurate chain of custody document. https://coreintegrity.com.au/workplace-investigations/chain-of-custody/
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago