ExamGecko
Question list
Search
Search

Related questions











Question 503 - CISA discussion

Report
Export

Which of the following BEST protects evidence in a forensic investigation?

A.
imaging the affected system
Answers
A.
imaging the affected system
B.
Powering down the affected system
Answers
B.
Powering down the affected system
C.
Protecting the hardware of the affected system
Answers
C.
Protecting the hardware of the affected system
D.
Rebooting the affected system
Answers
D.
Rebooting the affected system
Suggested answer: A

Explanation:

Imaging the affected system is the best way to protect evidence in a forensic investigation, because it creates a bit-by-bit copy of the original data that can be analyzed without altering or compromising the original source.Imaging preserves the integrity and authenticity of the evidence and allows for verification and validation of the results34.Powering down or rebooting the affected system can cause data loss or corruption, while protecting the hardware does not prevent unauthorized access or tampering with the software or data.Reference:3: CISA Review Manual (Digital Version), Chapter 6, Section 6.4.14: CISA Online Review Course, Module 6, Lesson 4

asked 18/09/2024
Neha Dua
41 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first