Certified Information Systems Auditor (CISA) — Question 1013

Following a security incident, which of the following BEST enables the integrity of the data captured during a forensic investigation?

Answer options

• A. An expert presenting the results of forensic analysis
• B. Comparison of the hash of data files in storage
• C. Comparison of the data with printouts from the investigation
• D. Maintenance of chain of custody

Correct answer: D

Explanation

The correct answer is D, as maintaining the chain of custody is crucial for preserving the integrity and authenticity of evidence during a forensic investigation. The other options, while important, do not directly ensure the integrity of the data captured; they are more about the presentation, comparison, or verification of data rather than its preservation.