When performing a forensic lockdown, the investigator is ensuring which of the following?:

The correct answer is D. All of the above. Option D is correct because a forensic lockdown encompasses all three of these security controls simultaneously - it is a comprehensive preservation action, not a single-purpose one. During a forensic lockdown, investigators restrict who can access evidence (access control)…

Question

Options

AAccess control
BAccess logging
CChain of custody
DAll of the above

How the community answered

(38 responses)

A
5% (2)
B
8% (3)
C
16% (6)
D
71% (27)

Explanation

Option D is correct because a forensic lockdown encompasses all three of these security controls simultaneously - it is a comprehensive preservation action, not a single-purpose one. During a forensic lockdown, investigators restrict who can access evidence (access control), maintain logs of every interaction with that evidence (access logging), and document every person who handles it to prove its integrity hasn't been compromised (chain of custody). Options A, B, and C are not wrong as individual concepts - they are each partially correct, which is precisely why D supersedes them; choosing any single lettered option would be incomplete and would misrepresent the full scope of what a lockdown achieves.

Memory tip: Think of forensic lockdown as a tripod - remove any one leg (control, logging, or custody) and the whole structure falls. The exam is testing whether you know lockdown is holistic, not selective.

Community Discussion

No community discussion yet for this question.

Full II0-001 Practice