easyMultiple SelectObjective-mapped
CISM Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for preserving digital evidence during an incident? (Select exactly 2)
⚠ Common exam trap
It's easy for candidates to confuse 'preserving evidence' with 'immediate remediation'—choosing actions like rebooting or scanning that seem helpful but actually destroy volatile data or alter the evidence, while the exam emphasizes forensic soundness and legal admissibility over speed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a forensic image of the hard drive using a write blocker
Creating a forensic image with a write blocker (Option A) is a best practice because it captures an exact bit-for-bit copy of the storage media without altering the original data. The write blocker intercepts write commands at the hardware or software level, ensuring the integrity of the evidence. This preserves the original state for later analysis and admissibility in legal proceedings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a forensic image of the hard drive using a write blocker
Why this is correct
Write blocker prevents alteration of original data.
- ✓
Document the chain of custody
Why this is correct
Chain of custody maintains evidence admissibility.
- ✗
Interview witnesses before collecting data
Why it's wrong here
Interviews are part of investigation but do not preserve evidence.
- ✗
Run antivirus scans on the affected system
Why it's wrong here
Scanning can modify files and timestamps.
- ✗
Reboot the system to clear memory
Why it's wrong here
Rebooting destroys volatile evidence.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.