Certified Information Systems Auditor (CISA) — Question 653

Which of the following would lead an IS auditor to conclude that the evidence collected during a digital forensic investigation would not be admissible in court?

Answer options

• A. The logs failed to identify the person handling the evidence.
• B. The person who collected the evidence is not qualified to represent the case.
• C. The evidence was not fully backed up using a cloud-based solution prior to the trial.
• D. The evidence was collected by the internal forensics team.

Correct answer: A

Explanation

The correct answer is A because proper chain of custody requires documentation of who handled the evidence to ensure its integrity. If the logs do not identify the individual responsible, it raises doubts about the evidence's reliability. Options B, C, and D do not directly impact the admissibility of the evidence in court as they pertain more to qualifications and methods rather than the chain of custody.