CISSP Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  To speed up the investigation process

  Why it's wrong here

  Chain of custody is a meticulous and often time-consuming process that involves detailed documentation of every transfer and access to evidence. Its primary objective is to establish the authenticity and integrity of evidence for legal admissibility, not to accelerate the investigation. The rigor required for proper chain of custody inherently adds time to the forensic process, as every step must be accurately recorded and verified.

• ✓

  To document who accessed the evidence and when

  Why this is correct

  Documenting who accessed the evidence and when is the fundamental purpose of maintaining a chain of custody during a forensic investigation. This process creates an unbroken, verifiable audit trail that identifies every individual who has handled or had control over a piece of evidence, along with the precise dates and times of these interactions. This meticulous record is essential for demonstrating that the evidence has not been tampered with, substituted, or compromised, thereby ensuring its integrity and legal admissibility in court.

• ✗

  To encrypt the evidence at rest

  Why it's wrong here

  While encrypting evidence at rest is a critical security control to protect its confidentiality and integrity from unauthorized access, it is a distinct measure from the chain of custody. Chain of custody focuses on documenting the chronological handling, transfer, and possession of evidence to prove its authenticity and prevent alteration. Encryption primarily addresses data security during storage, whereas chain of custody tracks the human interaction and physical/logical movement of the evidence itself.

• ✗

  To store evidence in a fireproof safe

  Why it's wrong here

  Storing evidence in a fireproof safe is an important physical security measure designed to protect the evidence from environmental damage, such as fire, and to prevent unauthorized physical access. However, while physical security is a crucial component of overall evidence preservation, it is not the primary purpose of the chain of custody. The chain of custody specifically tracks the provenance, handling history, and accountability of individuals interacting with the evidence, rather than solely its physical storage conditions.

Go deeper

Related to this question