CISM: Certified Information Security ManagerDemo

By Isaca · Question Mode

QuestionQ220

Incident Management

Which of the following is a fundamental practice for workstations used to perform a forensic investigation?

  • A A documented chain of custody log is kept for the workstations
  • B The workstations are only accessed by members of the forensics team
  • C Only forensics-related software is installed on the workstations
  • D The workstations are backed up and hardened on a regular basis
Explanation

Forensic workstations should be dedicated, controlled systems with only forensic-related software installed. Limiting software reduces the chance of unintended changes, contamination, or unvalidated tools affecting evidence and analysis results.

Community Discussion

No comments yet. Be the first to start the discussion!