CISM Incident Management Practice Question
An organization's incident response plan requires that evidence be preserved for potential litigation. Which of the following actions is MOST critical to ensure the admissibility of digital evidence?
⚠ Common exam trap
Many exam-takers confuse operational best practices (like creating forensic images or securing evidence) with the legal requirement for admissibility, which is fundamentally about proving an unbroken chain of custody through meticulous documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Documenting the chain of custody for all evidence collected.
Admissibility of digital evidence in court hinges on demonstrating that the evidence has not been tampered with from the moment of collection to presentation. The chain of custody is the legally mandated documentation that tracks every person who handled the evidence, the time and date of each transfer, and the purpose of each action. Without a complete and verifiable chain of custody, the opposing counsel can successfully argue that the evidence may have been altered, making it inadmissible regardless of how securely it was stored or imaged.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Storing evidence in a secure, access-controlled location.
Why it's wrong here
Secure storage is important but chain of custody is more critical for admissibility.
- ✗
Creating forensic images of all affected systems before remediation.
Why it's wrong here
Creating forensic images preserves the bit-for-bit state of storage media, but this action alone does not establish a documented chain of custody from seizure through analysis. The stem’s requirement for admissibility hinges on proving that evidence was not tampered with, which a forensic image does not automatically provide. This option is tempting because forensic imaging is the standard method for capturing volatile and non-volatile data for later examination, and it would be the correct choice if the question asked about preserving the integrity of the data itself rather than its legal admissibility.
- ✗
Encrypting all evidence files to prevent unauthorized access.
Why it's wrong here
Encryption protects confidentiality but not admissibility.
- ✓
Documenting the chain of custody for all evidence collected.
Why this is correct
Chain of custody is the foundation for evidence integrity in court.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.