SY0-701 · Question #573
Which of the following elements of digital forensics should a company use if it needs to ensure the integrity of evidence?
The correct answer is A. Preservation. Preservation is correct because it refers to the process of protecting evidence from alteration or destruction, which is the core requirement for maintaining integrity - a foundational principle in forensics (often enforced via write blockers, hashing, and chain of custody)…
Question
Which of the following elements of digital forensics should a company use if it needs to ensure the integrity of evidence?
Options
- APreservation
- BE-discovery
- CAcquisition
- DContainment
How the community answered
(37 responses)- A81% (30)
- B3% (1)
- C11% (4)
- D5% (2)
Explanation
Preservation is correct because it refers to the process of protecting evidence from alteration or destruction, which is the core requirement for maintaining integrity - a foundational principle in forensics (often enforced via write blockers, hashing, and chain of custody). E-discovery (B) is the legal process of identifying and collecting electronic data for litigation, focused on finding evidence rather than protecting it. Acquisition (C) is the act of collecting a forensic copy of data, which comes after preservation and doesn't inherently guarantee the original remains unaltered. Containment (D) is an incident response concept about limiting the spread of a threat, not a forensics integrity mechanism.
Memory tip: Think "P comes before everything" - you must Preserve evidence integrity before you can Acquire, analyze, or disclose it. If the question mentions integrity, chain of custody, or protecting original evidence, the answer is Preservation.
Community Discussion
No community discussion yet for this question.