BCS Exam CISMP-V9 Topic 1 Question 69 Discussion

Actual exam question for BCS's CISMP-V9 exam

Question #: 69
Topic #: 1

When handling and investigating digital evidence to be used in a criminal cybercrime investigation, which of the following principles is considered BEST practice?

ADigital evidence must not be altered unless absolutely necessary.

BAcquiring digital evidence cart only be carried on digital devices which have been turned off.

CDigital evidence can only be handled by a member of law enforcement.

DDigital devices must be forensically 'clean' before investigation.

Show Suggested Answer

Suggested Answer: D

by Maile at Mar 08, 2024, 02:19 AM

Limited Time Offer

25%

Off

Get Premium CISMP-V9 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Quinn

1 months ago

Option A is the way to go. Can't have the 'CSI' team messing with the digital evidence, right? That's a recipe for disaster!

upvoted 0 times

...

Gracia

1 months ago

Option D about 'forensically clean' devices is a bit overkill. As long as the evidence is properly handled and documented, that should be sufficient.

upvoted 0 times

...

Tammi

1 months ago

While law enforcement should be involved, I don't think digital evidence can only be handled by them. Trained forensic experts can also handle it properly.

upvoted 0 times

Celestine

13 days ago

Trained forensic experts can also handle digital evidence properly.

upvoted 0 times

...

Aleta

18 days ago

B) Acquiring digital evidence can only be carried on digital devices which have been turned off.

upvoted 0 times

...

Diane

1 months ago

A) Digital evidence must not be altered unless absolutely necessary.

upvoted 0 times

...

Bette

2 months ago

Option B doesn't seem right. Digital devices can be imaged and analyzed while still powered on, as long as proper precautions are taken.

upvoted 0 times

Fidelia

10 days ago

Option B doesn't seem right. Digital devices can be imaged and analyzed while still powered on, as long as proper precautions are taken.

upvoted 0 times

...

Gracie

15 days ago

B) Acquiring digital evidence can only be carried on digital devices which have been turned off.

upvoted 0 times

...

Jacklyn

1 months ago

A) Digital evidence must not be altered unless absolutely necessary.

upvoted 0 times

...

Whitney

2 months ago

I think option A is the best practice. Maintaining the integrity of digital evidence is crucial in a criminal investigation.

upvoted 0 times

Makeda

22 days ago

True, both options A and D are crucial for a successful cybercrime investigation.

upvoted 0 times

...

Yolando

25 days ago

I think option D is also important, ensuring that the digital devices are clean before investigation can prevent contamination.

upvoted 0 times

...

Evan

1 months ago

It's important to follow best practices to avoid any issues with the evidence later on.

upvoted 0 times

...

Carma

1 months ago

I agree, option A ensures that the digital evidence remains intact and unaltered.

upvoted 0 times

...

Lenna

2 months ago

I think option D is also important, digital devices must be forensically 'clean' before investigation to ensure accurate results.

upvoted 0 times

...

Ilene

3 months ago

I agree with Gilberto, altering digital evidence can compromise the integrity of the investigation.

upvoted 0 times

...

Gilberto

3 months ago

I think the best practice is option A, digital evidence must not be altered unless absolutely necessary.

upvoted 0 times

...