CISM: Certified Information Security ManagerDemo

By Isaca · Question Mode

QuestionQ284

Incident Management

An employee who denies allegations of downloading inappropriate material onto an organizational device has been terminated. Legal evidence must be collected to support the disciplinary action. Which of the following is the information security manager’s BEST recommendation?

  • A Delete all inappropriate material after taking a local copy
  • B Create a forensic image of the original file system
  • C Log in to the employee's device and create a local copy to USB drive
  • D Rely on server backup allowing strict access control
Explanation

A forensic image preserves a bit-for-bit copy of the original file system for analysis while protecting the original evidence from alteration. This supports evidence integrity and chain-of-custody requirements.

Community Discussion

No comments yet. Be the first to start the discussion!