hardMultiple SelectObjective-mapped
SSCP Practice Question: Which TWO of the following are appropriate…
Which TWO of the following are appropriate actions when preserving digital evidence at a crime/incident scene?
⚠ Common exam trap
ISC2 often tests the misconception that immediately powering off a system is always the safest action, but in digital forensics, this can destroy volatile evidence and trigger data loss or corruption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document all actions taken
Documenting all actions taken (Option A) is a fundamental principle of digital forensics, as it creates a verifiable chain of custody and ensures the integrity of evidence. This documentation includes timestamps, tools used, and any changes made to the system, which is critical for admissibility in legal proceedings. Without proper documentation, the evidence may be challenged as tampered or unreliable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document all actions taken
Why this is correct
Documentation ensures chain of custody and reproducibility.
- ✓
Take photographs of the scene
Why this is correct
Photographs provide a visual record of the state of evidence.
- ✗
Connect to the internet to check online resources
Why it's wrong here
Connecting to the internet could change system state or trigger remote wipe.
- ✗
Use the system to check files
Why it's wrong here
Using the system may alter data and should be avoided.
- ✗
Power off the system immediately
Why it's wrong here
Powering off can destroy volatile data; follow proper forensic procedures.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.