CISM Incident Management Practice Question
Which THREE of the following are essential elements of a forensic evidence handling procedure to ensure admissibility in court?
⚠ Common exam trap
A common misconception is that direct analysis on original systems is acceptable, but in forensic procedures, any direct manipulation of original media is prohibited to avoid altering the evidence and compromising its admissibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Placing a legal hold on relevant data
A legal hold is essential because it suspends the normal data retention and deletion policies, ensuring that potentially relevant evidence is preserved from alteration or destruction. This is a foundational step in the e-discovery process and directly supports the admissibility of evidence by demonstrating that the organization took proactive steps to prevent spoliation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Placing a legal hold on relevant data
Why this is correct
A legal hold prevents destruction of evidence.
- ✓
Maintaining a documented chain of custody
Why this is correct
Chain of custody tracks who handled evidence and when.
- ✗
Performing analysis directly on original systems
Why it's wrong here
Analysis on original systems can alter evidence; forensic copies should be used.
- ✗
Using automated tools without validation
Why it's wrong here
Tools must be validated to ensure accuracy and admissibility.
- ✓
Creating bit-for-bit forensic copies of affected media
Why this is correct
Forensic copies preserve the original state for analysis.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.