In the process of gathering evidence from a computer attack, a system administrator took a series of actions
which are listed below. Can you identify which one of these actions has compromised the whole evidence
collection process?

Which of the following cannot be undertaken in conjunction or while computer incident handling is ongoing?

Once evidence is seized, a law enforcement officer should emphasize which of the following?

To be admissible in court, computer evidence must be which of the following?

In addition to the Legal Department, with what company function must the collection of physical evidence be
coordinated if an employee is suspected?

Which disaster recovery plan test involves functional representatives meeting to review the plan in detail?

When preparing a business continuity plan, who of the following is responsible for identifying and prioritizing
time-critical systems?

During the salvage of the Local Area Network and Servers, which of the following steps would normally be
performed first?

Which of the following specifically addresses cyber-attacks against an organization’s IT systems?

Which of the following is the most complete disaster recovery plan test type, to be performed after successfully
completing the Parallel test?