nerdexam
EC-Council

312-49 · Question #175

In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact the ISP and request that…

The correct answer is B. The ISP can investigate computer abuse committed by their employees, but must preserve the. Under U.S. law (specifically the Electronic Communications Privacy Act / ECPA), ISPs have authority to investigate computer abuse committed by their own employees and are required to preserve relevant evidence when legally requested. They cannot freely investigate all…

Submitted by kev92· Apr 18, 2026Computer Forensics Investigation Process

Question

In conducting a computer abuse investigation you become aware that the suspect of the investigation is using ABC Company as his Internet Service Provider (ISP). You contact the ISP and request that they provide you assistance with your investigation. What assistance can the ISP provide?

Options

  • AThe ISP can investigate anyone using their service and can provide you with assistance
  • BThe ISP can investigate computer abuse committed by their employees, but must preserve the
  • CThe ISP cannot conduct any type of investigations on anyone and therefore cannot assist you
  • DISPs never maintain log files so they would be of no use to your investigation

How the community answered

(20 responses)
  • B
    90% (18)
  • C
    5% (1)
  • D
    5% (1)

Explanation

Under U.S. law (specifically the Electronic Communications Privacy Act / ECPA), ISPs have authority to investigate computer abuse committed by their own employees and are required to preserve relevant evidence when legally requested. They cannot freely investigate all subscriber activity without proper legal process (e.g., a subpoena or court order). ISPs do maintain log files, and they can cooperate with law enforcement within legal boundaries.

Topics

#ISP#Evidence Preservation#Legal Obligations#Investigation Support

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice