ISC2 CC Security Operations Practice Question
A security operations center (SOC) receives an alert about a possible insider threat. An employee in the finance department has been accessing large amounts of sensitive data outside of normal working hours and emailing it to a personal external email address. The SOC manager asks the analyst to preserve evidence for a potential legal case. Which of the following should the analyst do FIRST to ensure the evidence is admissible?
⚠ Common exam trap
The trap here is focusing on technical steps like imaging or containment, which are important, but overlooking that legal admissibility hinges first on a documented chain of custody.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the chain of custody for all evidence collected.
For evidence to be admissible in a legal case, a proper chain of custody must be established and documented from the outset. This ensures that the evidence has not been tampered with and can be traced from collection to presentation. While imaging and containment are important, they come after initiating the chain of custody to maintain integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document the chain of custody for all evidence collected.
Why this is correct
Documenting the chain of custody is essential for evidence admissibility. It records who handled the evidence, when, and how, ensuring integrity. This should be done from the moment evidence is identified and collected. It is the first step to ensure that any evidence gathered later can be traced and trusted in legal proceedings.
- ✗
Create a forensic image of the employee's workstation hard drive.
Why it's wrong here
Creating a forensic image is important, but it is not the first step. Before imaging, the analyst should ensure that volatile evidence (like RAM and network connections) is preserved and that a proper chain of custody is established. Also, imaging alone does not cover all evidence sources like email logs or server logs.
- ✗
Confront the employee and ask for an explanation.
Why it's wrong here
Confronting the employee could tip them off, leading to destruction of evidence or other actions that compromise the investigation. It is not a step to preserve evidence; in fact, it could jeopardize the case. The first step should be to secure and preserve evidence in a forensically sound manner.
- ✗
Disable the employee's network access immediately.
Why it's wrong here
Disabling network access might be a containment step, but it could alert the employee and lead to evidence destruction. Moreover, it does not directly address evidence preservation for legal admissibility. The first priority for legal cases is to establish and maintain a proper chain of custody.
Go deeper
Related to this question
Learn chapter
Security Operations Basics
Key term
Chain of custody
Chain of custody is a documented process that tracks the handling, transfer, and possession of evidence or digital assets from the moment they are collected until they are presented in court or used in an investigation.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.