Exam 220-1102 topic 1 question 352 discussion

In the scenario described, the breach already occurred (the employee copied financial data and left the company with it). However, the key point here is that the administrator documented the movement of the evidence, which demonstrates an attempt to properly handle and preserve evidence after the fact. Even though the breach has already happened, preserving the chain of custody refers to how the evidence (in this case, the portable hard drive and the data) is managed once it's discovered or collected, ensuring its integrity throughout the investigation process. The administrator's actions in documenting the evidence movement are aligned with maintaining a proper chain of custody, which is crucial for any subsequent investigation or legal actions. So, despite the breach already occurring, the action of documenting the evidence's movement is still considered preserving the chain of custody. Therefore, A. Preserving chain of custody remains the correct answer.