nerdexam
GIAC

GCIH · Question #230

Which of the following ensures that the investigation process of incident response team does not break any laws during the response to an incident?

The correct answer is C. Legal representative. The legal representative ensures that all investigation activities during incident response comply with applicable laws, regulations, and evidentiary standards.

Incident Response & Cyber Kill Chain

Question

Which of the following ensures that the investigation process of incident response team does not break any laws during the response to an incident?

Options

  • AInformation Security representative
  • BLead Investigator
  • CLegal representative
  • DHuman Resource

How the community answered

(27 responses)
  • B
    7% (2)
  • C
    89% (24)
  • D
    4% (1)

Why each option

The legal representative ensures that all investigation activities during incident response comply with applicable laws, regulations, and evidentiary standards.

AInformation Security representative

The Information Security representative focuses on containing and analyzing the technical aspects of the incident, not on ensuring legal compliance of investigative procedures.

BLead Investigator

The Lead Investigator manages and coordinates the overall investigation process but relies on legal counsel to determine what actions are lawfully permissible.

CLegal representativeCorrect

A legal representative is the designated team member responsible for ensuring that evidence collection, data access, and investigative procedures do not violate laws such as privacy statutes, computer crime laws, or chain-of-custody requirements. Their role is to provide real-time legal guidance throughout the incident response lifecycle, preventing the team from inadvertently taking actions that could expose the organization to liability or render evidence inadmissible.

DHuman Resource

Human Resources handles personnel-related matters such as employee discipline or notifications, not the legal boundaries of the investigation process.

Concept tested: Incident response team roles and legal compliance

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf

Topics

#IR team composition#legal representative#compliance#investigation legality

Community Discussion

No community discussion yet for this question.

Full GCIH Practice