What is the primary purpose of maintaining a chain of custody for digital evidence?

To determine the value of the evidence

To ensure that the evidence is collected in a timely manner

To ensure the evidence is stored in a secure location

To prove that the evidence has not been tampered with or altered

A forensic investigator is writing a report that will be used in a civil lawsuit. The investigator has found evidence that contradicts the plaintiff's claim. What is the investigator's ethical obligation?

Interpret the evidence in a way that supports the plaintiff's claim.

Present the evidence only if the plaintiff's attorney asks for it.

Report the contradictory evidence objectively, even if it weakens the plaintiff's case.

Omit the contradictory evidence to avoid confusing the court.

A first responder arrives at a scene where a computer is on and the user is still logged in. The responder notices that the user has an email client open with a draft message that appears relevant to the incident. What is the BEST action to preserve this evidence?

Close the email client to prevent the user from sending the draft.

Photograph the screen and then note the draft message in the investigation log.

Read the draft message aloud and record it on a voice recorder.

Copy the draft message to a USB drive immediately.

After completing a forensic analysis, an investigator must write a report for both legal counsel and the IT department. What is the MOST important characteristic of this report?

It is written in a persuasive style to convince the reader of the suspect's guilt.

It uses highly technical jargon to demonstrate expertise.

It is objective, factual, and clearly explains the methods and conclusions.

It includes only the evidence that supports the investigator's hypothesis.

A first responder arrives at a scene where a computer is powered on and displaying an open email application. What is the most appropriate initial action to preserve potential evidence?

Start using the computer to search for more evidence

Immediately unplug the power cord to prevent remote access

Close the email application to prevent further changes

Photograph the screen and then shut down the system normally

Systems Security Certified Practitioner

Domain 4Objective 2

4.2 - Understand and Support Forensic Investigations SSCP Practice Questions (Page 5)

Part of the Incident Response and Recovery domain, which accounts for 14% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

7concepts

14%of the exam

Questions 21–25

21foundation · easy
What is the primary purpose of maintaining a chain of custody for digital evidence?
Select an answer first
22expert · hard
A forensic investigator is writing a report that will be used in a civil lawsuit. The investigator has found evidence that contradicts the plaintiff's claim. What is the investigator's ethical obligation?
Select an answer first
23application · medium
A first responder arrives at a scene where a computer is on and the user is still logged in. The responder notices that the user has an email client open with a draft message that appears relevant to the incident. What is the BEST action to preserve this evidence?
Select an answer first
24application · medium
After completing a forensic analysis, an investigator must write a report for both legal counsel and the IT department. What is the MOST important characteristic of this report?
Select an answer first
25foundation · easy
A first responder arrives at a scene where a computer is powered on and displaying an open email application. What is the most appropriate initial action to preserve potential evidence?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.