Certified Information Systems Security Professional (CISSP) — Question 264

When performing an investigation with the potential for legal action, what should be the analyst's FIRST consideration?

Answer options

• A. Data decryption
• B. Chain-of-custody
• C. Authorization to collect
• D. Court admissibility

Correct answer: B

Explanation

The first priority in a legal investigation is ensuring the Chain-of-custody is maintained, as it is crucial for the integrity of evidence. Without proper Chain-of-custody, the evidence may be deemed inadmissible in court. While data decryption, authorization to collect, and court admissibility are important, they come after establishing the Chain-of-custody.