A security analyst is collecting evidence for a criminal investigation involving a compromised server. The analyst takes a forensic image of the hard drive. What is the most critical action to ensure the evidence is admissible in court?

Document every person who handled the evidence and every transfer of custody

Make multiple copies of the image and distribute them to the legal team

Store the original hard drive in a secure location and work only from the image

Encrypt the forensic image to prevent unauthorized access

Which of the following is an ethical consideration for security professionals involved in investigations?

Maintaining impartiality and avoiding conflicts of interest

Maximizing the severity of penalties for the accused

Deleting evidence that may be harmful to the organization

Sharing evidence with the public to ensure transparency

What is the primary purpose of an industry standards investigation?

To assess compliance with voluntary frameworks and best practices

To determine facts for internal corrective action

To gather evidence for criminal prosecution

To ensure compliance with government regulations

An administrative investigation is being conducted in a country with strict data protection laws. The security team wants to monitor an employee's work computer to gather evidence of policy violations. What is the most important legal consideration?

The employee's consent is not required if the computer is company-owned

The monitoring must be conducted by law enforcement

The company must obtain a warrant from a court

The employee must be notified of the monitoring in advance

A hospital receives a notice from the Department of Health and Human Services (HHS) stating that it is investigating a potential violation of HIPAA privacy rules. The hospital's security team is asked to provide access logs and policies. What is the primary purpose of this investigation?

To determine if the hospital violated a law and may face fines or sanctions

To determine if an employee violated internal policy

To assess compliance with voluntary industry best practices

To resolve a dispute between the hospital and a patient

Certified Information Systems Security Professional

Domain 1Objective 5

1.5 - Understand Requirements for Investigation Types (i.e., Administrative, Criminal, Civil, Regulatory, Industry Standards) CISSP Practice Questions (Page 4)

Part of the Security and Risk Management domain, which accounts for 16% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 1–2 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

10concepts

16%of the exam

Questions 16–20

16application · medium
A security analyst is collecting evidence for a criminal investigation involving a compromised server. The analyst takes a forensic image of the hard drive. What is the most critical action to ensure the evidence is admissible in court?
Select an answer first
17foundation · easy
Which of the following is an ethical consideration for security professionals involved in investigations?
Select an answer first
18foundation · easy
What is the primary purpose of an industry standards investigation?
Select an answer first
19expert · hard
An administrative investigation is being conducted in a country with strict data protection laws. The security team wants to monitor an employee's work computer to gather evidence of policy violations. What is the most important legal consideration?
Select an answer first
20application · medium
A hospital receives a notice from the Department of Health and Human Services (HHS) stating that it is investigating a potential violation of HIPAA privacy rules. The hospital's security team is asked to provide access logs and policies. What is the primary purpose of this investigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.