Here’s the Answer to the Question posted on Facebook
Q. A technician confiscated an employee’s computer after management learned the employee had unauthorized material on his system. Later, a security expert captured a forensic image of the system disk. However, the security expert reported the computer was left unattended for several hours before he captured the image. Which of the following is a potential issue if this incident goes to court?
A. Chain of custody
B. Order of volatility
C. Time offset
D. Lack of metrics
Answer available until November 13, 2016.
|Get over 400 Security+ (SY0-401 questions here).|
See Chapter 11 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide.