PrepAway - Latest Free Exam Questions & Answers

Which of the following is the MOST critical consideration when collecting and preserving admissible evidence d

Which of the following is the MOST critical consideration when collecting and preserving admissible evidence during an incident response?

PrepAway - Latest Free Exam Questions & Answers

A.
Unplugging the systems

B.
Chain of custody

C.
Separation of duties

D.
Clock synchronization

Explanation:
Admissible evidence must be collected and preserved by “chain of custody.” Unplugging the systems can cause potential loss of information critical to the investigation. Separation of duties is not necessary in evidence collection and preservation since the entire process can be done by a single person. Clock synchronization is not as important for the collection and preservation of admissible evidence.


Leave a Reply