Which of the following cannot be marked as evidence in a container?

Question

Options

• AAction result
• BComment
• CNote
• DArtifact

• A
  4% (1)
• B
  92% (23)
• D
  4% (1)

Explanation

Comments (B) cannot be marked as evidence in a container because they are informal annotations used for collaboration and communication - they exist as metadata about other items, not as standalone evidentiary objects that can be formally designated and tracked as evidence.

Why the distractors are wrong:

• A. Action result - The output of an action (e.g., a scan, query, or automated task) is a concrete, verifiable artifact that can be flagged as evidence.
• C. Note - Notes are formal, user-created records within a case container and can be designated as evidence to document findings or observations.
• D. Artifact - Artifacts are structured data objects (files, indicators, etc.) and are among the most common items marked as evidence.

Memory tip: Think of Comments like sticky notes on a whiteboard - they're conversational and contextual, not formal records. In contrast, Notes, Artifacts, and Action Results are "official" container contents that carry evidentiary weight. The key distinction is: Comments annotate; they don't substantiate.

No community discussion yet for this question.