Which incident response activity ensures proper evidence handling?

SY0-701 By islever Editorial Last updated

Short answer

B Chain of custody

Question

Which of the following incident response activities ensures evidence is properly handled?
  1. E-discovery
  2. Chain of custody Correct Answer
  3. Legal hold
  4. Preservation

Key Takeaways

The question tests the definition of chain of custody versus related legal concepts; the trap is confusing general preservation efforts with the specific documentation trail required for evidence validity.

Chain of custody is the critical process that documents the handling, transfer, and preservation of evidence to ensure its integrity. Community consensus overwhelmingly confirms B as the correct answer due to its role in maintaining legal admissibility.

Common mistake: Candidates often select Preservation (D) or Legal Hold (C), failing to distinguish between securing data and the continuous documentation of who handled it and when.

Expert Analysis

Why the Answer Is Correct

Chain of custody is the comprehensive procedure that tracks evidence from collection through presentation in court. It provides a verifiable record of every individual who accessed the evidence, ensuring no tampering occurred. This documentation is essential for proving the integrity of digital evidence in legal proceedings.

Why the Other Options Are Wrong

E-discovery (A) is the process of identifying and collecting electronically stored information for litigation, not the handling protocol itself. Legal hold (C) is a directive to preserve data but does not track physical or logical handling. Preservation (D) is an action to prevent data loss but lacks the audit trail component inherent to chain of custody.

Community Comment Notes

Commenters consistently highlight that chain of custody is the only option providing a complete audit trail. Several users noted that while preservation and legal holds are components, they do not fully satisfy the requirement for tracking evidence handling history. The community agreement reinforces that 'properly handled' implies accountability, which is the core function of chain of custody.

Exam Strategy

When asked about evidence integrity or tracking, immediately look for 'chain of custody.' Differentiate between actions that secure data (preservation) and processes that document access (chain of custody).

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. dbrowndiver 👍 7
    In this scenario, choice B is correct . Chain of custody is the correct answer because it is specifically designed to ensure that evidence is properly handled, tracked, and documented throughout the incident response process. This approach ensures the integrity and admissibility of evidence in legal settings by maintaining a clear and reliable record of its handling.
  2. Etc_Shadow28000 👍 5 Answered B
    B. Chain of custody Chain of custody is the process that ensures evidence is properly handled and documented throughout its lifecycle. It tracks the evidence from the time it is collected, through its transportation, storage, and presentation in court, ensuring that it has not been altered or tampered with. Maintaining a proper chain of custody is critical for ensuring the integrity and admissibility of the evidence in legal proceedings. Therefore, the correct answer is: B. Chain of custody
  3. SHADTECH123 👍 3 Answered B
    Chain of custody refers to the process of documenting the handling of evidence from the time it is collected until it is presented in court. This documentation includes details on who collected the evidence, how it was collected, transported, stored, and any transfers of possession
  4. 986d14e 👍 3 Answered B
    The answer is B. E-discovery has nothing to do with this.
  5. Punjistetics 👍 2 Answered B
    The correct answer is B. Chain of custody. Chain of custody refers to the documentation and processes used to maintain control and accountability of evidence during an investigation. It ensures that evidence is properly handled, preserved, and protected from tampering, alteration, or loss.
Show 4 more comments
  1. 9149f41 👍 1 Answered C
    Why C and D are not correct here: Evidence of the properly handled is a broader term that including the whole court order. Chain of custody is a broader concept that can include legal hold and preservation as part of its overall process.
  2. Abcd123321 👍 1 Answered B
    Chain of Custody ○ Documented and verifiable record that tracks the handling, transfer, and preservation of digital evidence from the moment it is collected until it is presented in a court of law
  3. Yoez 👍 3 Answered B
    for me is B
  4. Shaman73 👍 1 Answered B
    B. Chain of custody

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide