Certified Information Systems Security Professional (CISSP) — Question 118

Which of the following is the MOST important rule for digital investigations?

Answer options

• A. Ensure original data is never modified.
• B. Ensure systems are powered on.
• C. Ensure event logs are rotated.
• D. Ensure individual privacy is protected.

Correct answer: A

Explanation

The correct answer, A, emphasizes the importance of preserving original data integrity, which is essential for maintaining the validity of the investigation. Options B, C, and D, while important in their own contexts, do not prioritize the preservation of evidence as the most critical aspect of a digital investigation.