When developing an Incident Response Plan, you need procedures that ensure _________.

Question

BlackTom AI · Accepted Answer

Preserving digital and physical evidence requires a documented chain of custody that proves who handled items, when, how, and where, so evidence remains admissible and uncontaminated.

1) Relevant knowledge points and concepts
- Incident Response lifecycle phases: identification, containment, preservation, collection, analysis, eradication, recovery, and lessons learned.
- Evidence integrity: use of hashing, write-blocking, controlled storage, and documented handling to prevent alteration.
- Chain of custody: a log or form recording each transfer, custodian, date/time, purpose, and signatures; critical for legal and regulatory proceedings.
- Legal/admissibility requirements: courts and regulators require demonstrable continuity of custody and provenance.

2) Step-by-step reasoning
- An Incident Response Plan must include procedures to preserve potential evidence at discovery (isolate systems, stop volatile changes).
- After preservation, trained personnel must collect evidence using forensically sound methods (use write-blockers, create hashes).
- Each transfer (who took the device, who imaged it, who analyzed it) must be recorded with timestamps, reasons, and signatures.
- Secure storage with access controls and audit logs prevents unauthorized access or modification.
- These steps form a continuous documented chain showing evidence integrity from seizure through analysis and storage.

3) Calculations/intermediate steps
- No numeric calculations apply; procedural steps and documentation are the intermediate “steps” for maintaining admissibility.

4) Why the correct answer is correct
- "Proper chain of custody of evidence" directly addresses preservation, documentation, and continuity needed for legal use of evidence; these are explicit goals of IR procedures.

5) Why the other options are incorrect
- "That attacks are being detected": important for security operations but not the procedural guarantee sought in evidence handling.
- "That logs are being created": also important, but creation of logs alone does not ensure their admissibility or preserved integrity.
- "That the evidence is destroyed quickly": contrary to forensic goals; destroying evidence defeats investigation and legal processes.

Conclusion: The correct and supported choice is “proper chain of custody of evidence,” matching the provided answer.

When developing an Incident Response Plan, you need procedures that ensure _________.单项选择题

类似问题

What is the primary purpose of the Act stage in the OODA loop?

Which of the following Incident handling process phases is responsible for defining rules, collaborating human workforce, creating a back-up plan, and testing the plans for an enterprise?

An Incident Response Plan does NOT _________.

Establishing logging, monitoring, and response procedures for security incidents occurs during:

更多留学生实用工具

智能学习助手

风格化写作助手

论文查重助手

文献引用助手

课堂转译助手

课堂笔记助手

Quiz搜索助手

学校历年真题

智能刷题助手

智能匹配练习

希望你的学习变得更简单