nerdexam
CompTIA

CAS-002 · Question #782

A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalability to adequately…

The correct answer is C. Using a community cloud with adequate controls. A community cloud shared by organizations with common legal and compliance obligations provides the scalability needed while preserving the chain-of-custody controls critical to e-discovery work.

Integration of Computing, Communications and Business Disciplines

Question

A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalability to adequately serve their clients. Since it is an e-discovery firm where chain of custody is important, which of the following scenarios should they consider?

Options

  • AOffload some data processing to a public cloud
  • BAligning their client intake with the resources available
  • CUsing a community cloud with adequate controls
  • DOutsourcing the service to a third party cloud provider

How the community answered

(36 responses)
  • A
    8% (3)
  • B
    3% (1)
  • C
    78% (28)
  • D
    11% (4)

Why each option

A community cloud shared by organizations with common legal and compliance obligations provides the scalability needed while preserving the chain-of-custody controls critical to e-discovery work.

AOffload some data processing to a public cloud

A public cloud is available to the general public and lacks the dedicated compliance controls and auditability required to maintain legal chain of custody.

BAligning their client intake with the resources available

Aligning client intake to existing resources solves neither the scalability problem nor the inadequate infrastructure, and limits the firm's ability to serve clients.

CUsing a community cloud with adequate controlsCorrect

NIST defines a community cloud as infrastructure provisioned for exclusive use by a specific community of consumers with shared concerns such as mission, security requirements, or compliance obligations. For an e-discovery firm, a community cloud shared with other legal or forensic organizations includes contractual and technical controls - such as audit logging and custodial accountability - that support chain of custody, while also providing greater scale than the firm can afford alone.

DOutsourcing the service to a third party cloud provider

Outsourcing to a generic third-party cloud provider does not guarantee the shared legal compliance posture or chain-of-custody controls specific to e-discovery requirements.

Concept tested: Community cloud deployment model for compliance-sensitive workloads

Source: https://csrc.nist.gov/publications/detail/sp/800-145/final

Topics

#community cloud#chain of custody#e-discovery#cloud governance

Community Discussion

No community discussion yet for this question.

Full CAS-002 Practice