(ISC)2(ISC)2
SSCP · Question #933
SSCP Question #933: Real Exam Question with Answer & Explanation
Sign in or unlock SSCP to reveal the answer and full explanation for question #933. The question stem and answer options stay visible for context.
Submitted by khalil_dz· Apr 18, 2026Incident Response and Recovery
Question
If an employee's computer has been used by a fraudulent employee to commit a crime, the hard disk may be seized as evidence and once the investigation is complete it would follow the normal steps of the Evidence Life Cycle. In such case, the Evidence life cycle would not include which of the following steps listed below?
Options
- AAcquisition collection and identification
- BAnalysis
- CStorage, preservation, and transportation
- DDestruction
Unlock SSCP to see the answer
You've previewed enough free SSCP questions. Unlock SSCP for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#Digital Forensics#Evidence Handling#Chain of Custody#Incident Response