CompTIA CASP+ (CAS-004) — Question 225

A local government that is investigating a data exfiltration claim was asked to review the fingerprint of the malicious user's actions. An investigator took a forensic image of the VM and downloaded the image to a secured USB drive to share with the government.
Which of the following should be taken into consideration during the process of releasing the drive to the government?

Answer options

• A. Encryption in transit
• B. Legal issues
• C. Chain of custody
• D. Order of volatility
• E. Key exchange

Correct answer: C

Explanation

The correct answer is C, Chain of custody, as it ensures that the evidence is properly documented and protected from tampering. Options A, B, D, and E, while important in their own contexts, do not specifically address the integrity and traceability of the forensic evidence being shared.