Which of the following should a computer forensics lab used for investigations have?

While 'isolation' of networks or devices is important within an investigation, 'isolation' as a general characteristic of the lab itself is less precise than 'restricted access' for physical security.

Restricted access is crucial for a computer forensics lab to prevent unauthorized personnel from tampering with evidence, equipment, or ongoing investigations. This control ensures the integrity and chain of custody of digital evidence, which is vital for its admissibility in legal proceedings by demonstrating that the evidence has not been compromised.

'Open access' directly contradicts the fundamental security requirements for handling sensitive legal evidence and maintaining its integrity.

While 'an entry log' is a good practice for maintaining an audit trail, it is a *mechanism* to support 'restricted access' rather than the overarching requirement itself.