Which of the following is a reason proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response?

Question

Options

• ATo ensure the report is legally acceptable in case it needs to be presented in court
• BTo present a lessons-learned analysis for the incident response team
• CTo ensure the evidence can be used in a postmortem analysis
• DTo prevent the possible loss of a data source for further root cause analysis

• A
  77% (17)
• B
  5% (1)
• C
  14% (3)
• D
  5% (1)

Explanation

Proper handling and reporting of existing evidence are important for the investigation and reporting phases of an incident response because they ensure the integrity, authenticity, and admissibility of the evidence in case it needs to be presented in court. Evidence that is mishandled, tampered with, or poorly documented may not be accepted by the court or may be challenged by the opposing party. Therefore, incident responders should follow the best practices and standards for evidence collection, preservation, analysis, and reporting.

No community discussion yet for this question.