CAS-002 · Question #815
A user is suspected of engaging in potentially illegal activities. Law enforcement has requested that the user continue to operate on the network as normal. However, they would like to have a copy…
The correct answer is C. Place a legal hold on the user's email account. Next, perform e-discovery searches to collect. A legal hold preserves all data in place to prevent deletion, while e-discovery searches identify communications matching specific key terms for law enforcement.
Question
A user is suspected of engaging in potentially illegal activities. Law enforcement has requested that the user continue to operate on the network as normal. However, they would like to have a copy of any communications from the user involving certain key terms. Additionally, the law enforcement agency has requested that the user's ongoing communication be retained in the user's account for future investigations. Which of the following will BEST meet the goals of law enforcement?
Options
- ABegin a chain-of-custody on for the user's communication. Next, place a legal hold on the user's
- BPerform an e-discover using the applicable search terms. Next, back up the user's email for a
- CPlace a legal hold on the user's email account. Next, perform e-discovery searches to collect
- DPerform a back up of the user's email account. Next, export the applicable emails that match the
How the community answered
(27 responses)- A4% (1)
- B7% (2)
- C74% (20)
- D15% (4)
Why each option
A legal hold preserves all data in place to prevent deletion, while e-discovery searches identify communications matching specific key terms for law enforcement.
A chain-of-custody process documents evidence handling integrity but does not preserve ongoing communications in the account or enable keyword-based collection.
Performing e-discovery before placing a legal hold risks missing communications that arrive after the discovery run and does not ensure ongoing retention in the user's account.
Placing a legal hold on the email account first ensures all existing and incoming messages are preserved without alerting the user or allowing accidental deletion, satisfying the ongoing retention requirement. E-discovery searches are then used to identify and collect communications containing the specified key terms for law enforcement review. This sequence correctly prioritizes preservation before collection, which is the standard forensic and legal process for active investigations.
Backing up the email account captures a point-in-time snapshot but does not preserve ongoing communications in the account as required by law enforcement.
Concept tested: Legal hold and e-discovery for email preservation
Source: https://learn.microsoft.com/en-us/purview/ediscovery-create-holds
Topics
Community Discussion
No community discussion yet for this question.