easyMultiple ChoiceObjective-mapped
CISM Practice Question: During an incident, the incident response team…
During an incident, the incident response team needs to preserve evidence for legal proceedings. Which of the following is the MOST important action to take?
⚠ Common exam trap
Many candidates choose 'Notify law enforcement immediately' because they assume legal proceedings require early police involvement, but the CISM exam emphasizes that evidence preservation and chain of custody must be secured first, and law enforcement notification is a separate decision based on legal counsel and organizational policy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a forensic image of affected systems using write-blockers.
Creating a forensic image of affected systems using write-blockers is the most important action because it preserves the original data in a bit-for-bit, unaltered state, ensuring the evidence is admissible in legal proceedings. Write-blockers prevent any write operations to the source drive, maintaining the integrity of the evidence chain of custody. Without a forensically sound image, any subsequent analysis could be challenged as tampered or unreliable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a forensic image of affected systems using write-blockers.
Why this is correct
Creating a forensic image with write-blockers ensures evidence integrity.
- ✗
Document the incident in a free-form text.
Why it's wrong here
Documenting the incident in free-form text is insufficient because it lacks the structure and chain-of-custody controls required for legally admissible evidence. Proper documentation must be systematic and forensically sound.
- ✗
Take screenshots of system logs.
Why it's wrong here
Taking screenshots of system logs is unreliable for evidence preservation because screenshots can be easily altered or taken out of context, and they do not capture the underlying data for thorough forensic analysis.
- ✗
Notify law enforcement immediately.
Why it's wrong here
Law enforcement is notified after evidence preservation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.