mediumMultiple ChoiceObjective-mapped
CISM Practice Question: During incident response, a forensic investigator…
During incident response, a forensic investigator needs to collect evidence from a compromised server. Which action BEST preserves evidence integrity?
⚠ Common exam trap
Test-takers frequently choose a graceful shutdown (Option A) thinking it is safer, but CISM emphasizes that any OS-level action can alter evidence, and the hard power-off is the only way to guarantee the disk is frozen in its current state.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pull the power cord
Pulling the power cord (Option C) is the best action because it immediately halts all system processes and prevents any further writes to the disk, preserving the exact state of the storage media at the time of incident. This method avoids the risk of the operating system altering metadata, logs, or file timestamps during a graceful shutdown, which could compromise forensic integrity. It also ensures that volatile memory (RAM) content is lost, but for disk-based evidence, this is the standard approach to maintain a pristine bit-for-bit copy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Perform a graceful shutdown
Why it's wrong here
Graceful shutdown alters state and destroys evidence.
- ✗
Create a network-based image
Why it's wrong here
Network imaging does not capture memory and may be altered during transmission.
- ✓
Pull the power cord
Why this is correct
Hard power loss freezes volatile memory and stops all processes.
- ✗
Copy files to an external drive
Why it's wrong here
File copy modifies metadata and may miss hidden data.
Go deeper
Related to this question
About these practice questions
This CISM question is part of Courseiva's 871-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.