220-801 Question #618: Real Exam Question with Answer & Explanation

The correct answer is C: To ensure evidence is admissible in legal proceeding. Chain of custody documentation ensures that evidence handling meets the legal standards required for it to be accepted as valid in court proceedings.

Question

Chain of custody needs to be kept intact for which of the following reasons?

Options

ATo ensure data preservation during evidence inspection
BTo ensure that the evidence is not left at the scene
CTo ensure evidence is admissible in legal proceeding
DTo ensure evidence is returned to proper owner

Explanation

Chain of custody documentation ensures that evidence handling meets the legal standards required for it to be accepted as valid in court proceedings.

Common mistakes.

A. Data preservation during inspection is addressed by forensic imaging and write-blocking techniques, not by chain of custody documentation itself.
B. Ensuring evidence is not left at the scene is a collection responsibility handled during the initial evidence gathering phase, separate from the ongoing chain of custody process.
D. Returning evidence to its owner is a post-case property management step that is unrelated to the legal purpose chain of custody serves during an investigation and trial.

Concept tested. Chain of custody purpose in digital forensics

Reference. https://learn.microsoft.com/en-us/compliance/assurance/assurance-forensic-investigation

Community Discussion

No community discussion yet for this question.

Full 220-801 Practice