CISSP Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Storing evidence on a shared network drive

  Why it's wrong here

  Storing forensic evidence on a shared network drive is highly detrimental to maintaining the chain of custody. Such locations typically lack the stringent access controls necessary to prevent unauthorized viewing, modification, or deletion of critical evidence. This practice makes it nearly impossible to definitively prove that the evidence has not been tampered with, thereby compromising its admissibility in legal proceedings. Dedicated, secure, and access-controlled storage is always required.

• ✗

  Encrypting the evidence file to prevent viewing

  Why it's wrong here

  Encrypting the evidence file primarily addresses confidentiality, preventing unauthorized viewing, and can contribute to integrity if authenticated encryption is used. However, encryption itself does not directly establish or maintain the chain of custody. The chain of custody is a meticulous record of possession and handling, documenting who had the evidence, when, and where, regardless of its encrypted state. While a good security practice, it doesn't replace the procedural documentation required for custody.

• ✓

  Labeling evidence with date, time, and collector's name

  Why this is correct

  Labeling evidence immediately upon collection with essential details such as the date, time, and the name of the collector is a fundamental step in establishing a robust chain of custody. This initial documentation provides an irrefutable starting point for the evidence's lifecycle, clearly identifying when and by whom it was first secured. Accurate labeling ensures that each piece of evidence can be uniquely identified and tracked throughout the entire forensic process, preventing mix-ups and disputes over its origin.

• ✗

  Performing a hash of the evidence immediately

  Why it's wrong here

  Performing a cryptographic hash of the evidence immediately after acquisition is a critical step for ensuring data integrity, creating a unique digital fingerprint that can detect any subsequent alteration. However, hashing alone does not directly maintain the chain of custody. The chain of custody is concerned with the physical and logical control of the evidence, documenting its possession and transfer, whereas hashing merely verifies that the data itself has not changed since the hash was computed. Both are crucial but serve distinct purposes.

• ✓

  Documenting each person who handled the evidence

  Why this is correct

  Documenting every individual who handles the evidence, along with the dates, times, and reasons for transfer, is absolutely essential for maintaining an unbroken chain of custody. This meticulous record provides a complete audit trail of possession, demonstrating that the evidence has been continuously accounted for and protected from unauthorized access or alteration. It establishes accountability for every transfer, ensuring that the integrity and authenticity of the evidence can be legally upheld in court.

Go deeper

Related to this question