Which action is a required step when collecting evidence from a crime scene to preserve its integrity?

Turn off the device immediately to prevent remote access

Copy the data to a new hard drive and then analyze the original

Photograph the evidence in place before moving it

Label the evidence with the analyst's name only

An investigator is analyzing a compromised server and needs to determine when an attacker first gained access. Which digital artifact would provide the most reliable evidence of the initial access?

The attacker's IP address from a firewall log.

System event logs showing successful logins.

The server's current configuration files.

An investigator is preparing a report for a legal case involving a network intrusion. The report must be clear and defensible. Which approach is most appropriate for presenting the findings?

Include only the conclusions and recommendations.

Use technical jargon to demonstrate expertise.

Summarize the findings in a single paragraph without technical details.

Include a timeline of events, the evidence collected, and the chain of custody for each item.

Certified Information Systems Security Professional

Domain 7Objective 1

7.1 - Understand and Comply with Investigations CISSP Practice Questions (Page 6)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

13%of the exam

Questions 26–29

26foundation · easy
Which action is a required step when collecting evidence from a crime scene to preserve its integrity?
Select an answer first
27application · medium
An investigator is analyzing a compromised server and needs to determine when an attacker first gained access. Which digital artifact would provide the most reliable evidence of the initial access?
Select an answer first
28foundation · easy
Which of the following is an example of a digital artifact found on a computer system?
Select an answer first
29expert · hard
An investigator is preparing a report for a legal case involving a network intrusion. The report must be clear and defensible. Which approach is most appropriate for presenting the findings?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

7.1 - Understand and Comply with Investigations CISSP Practice Questions (Page 6)

Questions 26–29

Which action is a required step when collecting evidence from a crime scene to preserve its integrity?

An investigator is analyzing a compromised server and needs to determine when an attacker first gained access. Which digital artifact would provide the most reliable evidence of the initial access?

Which of the following is an example of a digital artifact found on a computer system?

An investigator is preparing a report for a legal case involving a network intrusion. The report must be clear and defensible. Which approach is most appropriate for presenting the findings?

Keep studying — Security Operations