Certified Information Systems Auditor CISA · Free Practice Question Easy

Question 48

You are an information system auditor of HDA Inc. You are reviewing the forensic data collection and preservation procedures. Which of the following is MOST important to include in these procedures?
  • A A. Maintaining a detailed log of data collection activities.
  • B B. Conducting thorough data analysis and interpretation.
  • C C. Preserving the chain of custody.
  • D D. Using specialized forensic tools and software.
Reveal correct answer

Correct answer: C

Explanation

Correct Answer: C. Preserving the chain of custody. Explanation: When it comes to forensic data collection and preservation procedures, the most important aspect to include is preserving the chain of custody. Here's why the other options are not the most important: A. Maintaining a detailed log of data collection activities (option A) is essential for documenting the steps taken during the process, but it is not as critical as preserving the chain of custody. The chain of custody ensures that the integrity and admissibility of the collected evidence are maintained throughout its lifecycle. B. Conducting thorough data analysis and interpretation (option B) is a subsequent step in the forensic investigation process, but it is not specific to the collection and preservation procedures. While analysis and interpretation are important, they are separate activities that follow after the data has been properly collected and preserved. D. Using specialized forensic tools and software (option D) is indeed important for effective forensic data collection and analysis, but it is not the most important aspect. The use of specialized tools enhances the efficiency and accuracy of the process but does not directly address the critical requirement of maintaining the chain of custody. In summary, when conducting forensic data collection and preservation, the most important aspect to include in the procedures is preserving the chain of custody. This ensures the integrity and admissibility of the evidence and is crucial for maintaining the credibility of the forensic investigation.

Discussion

Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.

You must be logged in to post a comment.

Preparing For

Your Certification?

255+ certifications
Detailed explanations
Free PDF samples

Has All The Questions You Need