Which of the following is a reason proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response?
A.
To ensure the report is legally acceptable in case it needs to be presented in court
B.
To present a lessons-learned analysis for the incident response team
C.
To ensure the evidence can be used in a postmortem analysis
D.
To prevent the possible loss of a data source for further root cause analysis
Correct Answer: A. To ensure the report is legally acceptable in case it needs to be presented in court
Analysis: The proper handling and reporting of evidence are crucial to ensure that the evidence is legally admissible if it needs to be presented in court. Adhering to strict procedures for evidence preservation, documentation, and chain of custody ensures that the evidence remains untampered and credible, which is vital in legal proceedings.
This section is not available anymore. Please use the main Exam Page.CS0-003 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
fuzzyguzzy
Highly Voted 5 months, 1 week agonoa808a
Most Recent 2 weeks, 6 days agoluiiizsoares
5 months, 1 week agoOdogwu3024
8 months, 3 weeks ago