Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.
Location Chicago IL, USA

Exam CISSP topic 1 question 295 discussion

Actual exam question from ISC's CISSP
Question #: 295
Topic #: 1
[All CISSP Questions]

What should be the FIRST action to protect the chain of evidence when a desktop computer is involved?

  • A. Take the computer to a forensic lab
  • B. Make a copy of the hard drive
  • C. Start documenting
  • D. Turn off the computer
Show Suggested Answer Hide Answer

Suggested Answer: C

Comments

God2029
2 months ago
Typo: Cybex 8th Edition page 1355
upvoted 1 times
...
God2029
2 months ago
It is C, when an incident happens the first option is to note down the time and description of the event. Answer B would be the second option When evidence is labeled to preserve the chain of custody, the label should include the following types of information regarding the collection: General description of the evidence Time and date the evidence was collected Exact location the evidence was collected from Name of the person collecting the evidence Relevant circumstances surrounding the collection Cybex 9th Edition page 1355
upvoted 1 times
...
kabwitte
2 months, 1 week ago
It is C
upvoted 1 times
...
Snickers
2 months, 1 week ago
It's definitely C. It says to protect the chain of evidence. Imaging the harddrive is something you do in forensics, but documentation (such as chain of custody), is critical. Without it, that hard drive image means nothing in court
upvoted 2 times
...
manhattan
2 months, 3 weeks ago
there is a similar question that states the B answer, besides a hard drive copy seems a plausible answer. what do you all think?
upvoted 1 times
manhattan
2 months ago
after better reading, yes answer C is correct, making a copy of the disk could be the second task to do, not the first
upvoted 1 times
...
...
el_chulo
3 months, 1 week ago
C.. https://projects.nfstc.org/property_crimes/module03/pro_m03_t17.htm
upvoted 4 times
BuckLee
4 days, 14 hours ago
was thinking D but after reading this I would chose C as well.
upvoted 1 times
...
...
devilend
3 months, 2 weeks ago
it go for B
upvoted 1 times
...

SaveCancel