200-201 Question 201
Select 3A cybersecurity analyst is investigating an incident involving unauthorized access to a company's database. The analyst collects a hard drive from the compromised server as evidence. To ensure proper chain of custody, which actions should the analyst take during evidence handling?
- A
Document every transfer of the hard drive with dates, times, and involved personnel.
- B
Encrypt the hard drive before transferring it to another investigator.
- C
Store the hard drive in a secure, tamper-proof container when not in use.
- D
Ensure only the cybersecurity analyst has access to the hard drive until the investigation is complete.
- E
Assign a unique identifier to the hard drive and label it clearly.
Show answer and explanation
Correct answers: A, C, E
Explanation
Chain of custody involves maintaining the integrity and security of evidence by documenting its handling, ensuring secure storage, and using proper labeling for tracking. This ensures the evidence remains reliable for legal or investigative purposes. Actions like documenting transfers, using secure storage, and assigning unique identifiers are critical steps in this process.
- A. Correct.
Documenting every transfer of the evidence is crucial to maintain an unbroken chain of custody and ensure the evidence's integrity and admissibility in legal proceedings.
- B. Incorrect.
Encrypting the hard drive is not a standard chain of custody procedure and may alter the original state of the evidence, which could compromise its integrity.
- C. Correct.
Storing the evidence in a secure, tamper-proof container protects it from unauthorized access or physical damage, which is essential for maintaining its integrity.
- D. Incorrect.
Restricting access solely to one person is not a realistic or necessary requirement for chain of custody. Instead, proper documentation and secure handling procedures should be followed.
- E. Correct.
Assigning a unique identifier to the evidence ensures it can be accurately tracked and identified throughout the investigation process, which is a fundamental part of chain of custody.