Which incident response activity ensures proper evidence handling?

Incident Response and Management

Which of the following incident response activities ensures evidence is properly handled?

  1. E-discovery
  2. Chain of custody Source Reference Answer
  3. Legal hold
  4. Preservation

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests the definition of chain of custody versus related legal concepts; the trap is confusing general preservation efforts with the specific documentation trail required for evidence validity.

Chain of custody is the critical process that documents the handling, transfer, and preservation of evidence to ensure its integrity. Community consensus overwhelmingly confirms B as the correct answer due to its role in maintaining legal admissibility.

Candidates often select Preservation (D) or Legal Hold (C), failing to distinguish between securing data and the continuous documentation of who handled it and when.

Community Discussion (11 comments)

dbrowndiver 👍 7
In this scenario, choice B is correct . Chain of custody is the correct answer because it is specifically designed to ensure that evidence is properly handled, tracked, and documented throughout the incident response process. This approach ensures the integrity and admissibility of evidence in legal settings by maintaining a clear and reliable record of its handling.
Etc_Shadow28000 👍 5 Selected: B
B. Chain of custody Chain of custody is the process that ensures evidence is properly handled and documented throughout its lifecycle. It tracks the evidence from the time it is collected, through its transportation, storage, and presentation in court, ensuring that it has not been altered or tampered with. Maintaining a proper chain of custody is critical for ensuring the integrity and admissibility of the evidence in legal proceedings. Therefore, the correct answer is: B. Chain of custody
9149f41 👍 1 Selected: C
Why C and D are not correct here: Evidence of the properly handled is a broader term that including the whole court order. Chain of custody is a broader concept that can include legal hold and preservation as part of its overall process.
986d14e 👍 3 Selected: B
The answer is B. E-discovery has nothing to do with this.
93a09c9 👍 3 Selected: B
The answer is B. E-discovery has nothing to do with this.
Shaman73 👍 1 Selected: B
B. Chain of custody
SHADTECH123 👍 3 Selected: B
Chain of custody refers to the process of documenting the handling of evidence from the time it is collected until it is presented in court. This documentation includes details on who collected the evidence, how it was collected, transported, stored, and any transfers of possession
Abcd123321 👍 1 Selected: B
Chain of Custody ○ Documented and verifiable record that tracks the handling, transfer, and preservation of digital evidence from the moment it is collected until it is presented in a court of law
Yoez 👍 3 Selected: B
for me is B
shady23 👍 2 Selected: B
B. Chain of custody
Punjistetics 👍 2 Selected: B
The correct answer is B. Chain of custody. Chain of custody refers to the documentation and processes used to maintain control and accountability of evidence during an investigation. It ensures that evidence is properly handled, preserved, and protected from tampering, alteration, or loss.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Chain of custody is the comprehensive procedure that tracks evidence from collection through presentation in court. It provides a verifiable record of every individual who accessed the evidence, ensuring no tampering occurred. This documentation is essential for proving the integrity of digital evidence in legal proceedings.

Why the Other Options Are Wrong

E-discovery (A) is the process of identifying and collecting electronically stored information for litigation, not the handling protocol itself. Legal hold (C) is a directive to preserve data but does not track physical or logical handling. Preservation (D) is an action to prevent data loss but lacks the audit trail component inherent to chain of custody.

Community Comment Notes

Commenters consistently highlight that chain of custody is the only option providing a complete audit trail. Several users noted that while preservation and legal holds are components, they do not fully satisfy the requirement for tracking evidence handling history. The community agreement reinforces that 'properly handled' implies accountability, which is the core function of chain of custody.

Official Reference

https://www.nist.gov/publications/forensics-and-digital-evidence-introduction

Exam Strategy

When asked about evidence integrity or tracking, immediately look for 'chain of custody.' Differentiate between actions that secure data (preservation) and processes that document access (chain of custody).

Related Analysis

A security team is reviewing the findings in a report that w

A-Grade

A coffee shop owner wants to restrict internet access to onl

A-Grade

An enterprise has been experiencing attacks focused on explo

S-Grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide