You company suspects an employee of sending unauthorized emails to competitors. These emails are alleged to contain confidential company dat

The correct answer is A. Which of the following is the most important step for you to take in preserving the chain of custody? In order to preserve chain of custody, you should immediately create a mirror image of the hard drive on the email server. Then preserve the original hard drive and use the mirrored for your server. This is the best way to guarantee that all email records are not only…

Security Operations Management

Question

Options

AWhich of the following is the most important step for you to take in preserving the chain of custody?
BPreserve the email server including all logs.
CSeize the employee's PC.
DMake copies of that employee's email.
EPlace spyware on the employee's PC to confirm these activities.

How the community answered

(27 responses)

A
59% (16)
B
22% (6)
C
7% (2)
D
7% (2)
E
4% (1)

Explanation

In order to preserve chain of custody, you should immediately create a mirror image of the hard drive on the email server. Then preserve the original hard drive and use the mirrored for your server. This is the best way to guarantee that all email records are not only preserved, but are not

Topics

#Chain of Custody#Incident Response#Digital Forensics#Evidence Preservation

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSMP Practice