Which of the following is an information security manager's MOST important consideration during the investigative process of analyzing the hard drive of a compromised endpoint?

The correct answer is A. Maintaining chain of custody. The most important consideration during the investigative process of analyzing the hard drive of a compromised endpoint is maintaining the chain of custody. This ensures that the evidence collected is preserved in its original state and can be used in legal or regulatory proceedi

Submitted by katya_ua· Apr 18, 2026Information Security Incident Management

Question

Options

AMaintaining chain of custody
BMaintaining confidentiality of the incident
CNotifying relevant stakeholders
DIsolating the endpoint from the network

How the community answered

(19 responses)

A
84% (16)
B
11% (2)
D
5% (1)

Explanation

The most important consideration during the investigative process of analyzing the hard drive of a compromised endpoint is maintaining the chain of custody. This ensures that the evidence collected is preserved in its original state and can be used in legal or regulatory proceedings if necessary. Proper documentation of who handled the evidence and when it was handled is critical to maintaining the integrity of the investigation.

Topics

#Incident Response#Digital Forensics#Chain of Custody#Evidence Handling

Community Discussion

No community discussion yet for this question.

Full CISM Practice