Understanding Cisco Cybersecurity Fundamentals (SECFND, legacy) — Question 9

The way you document and preserve evidence from the time you start the cyber forensics investigation to the time the evidence is presented in court is referred to as which of the following?

Answer options

• A. Chain of compromise
• B. Custody of compromise
• C. Chain of forensics
• D. Chain of custody

Correct answer: C

Explanation

The correct answer is 'Chain of custody,' which refers to the documented process that ensures evidence is legally admissible in court by tracking its handling. 'Chain of compromise' and 'Custody of compromise' are incorrect terms and do not pertain to the preservation of evidence, while 'Chain of forensics' is misleading as it does not accurately describe the legal documentation process.