2 cissp ® Official Study Guide Eighth Edition

A.
Administrative
B.
Civil
C.
Criminal
D.
Regulatory
12.
During an operational investigation, what type of analysis might an organization undertake 
to prevent similar incidents in the future?
A.
Forensic analysis
B.
Root-cause analysis
C.
Network traffic analysis
D.
Fagan analysis

---

868
Chapter 19 
■
Investigations and Ethics
13.
What step of the Electronic Discovery Reference Model ensures that information that may 
be subject to discovery is not altered?
A.
Preservation
B.
Production
C.
Processing
D.
Presentation
14.
Gary is a system administrator and is testifying in court about a cybercrime incident. He 
brings server logs to support his testimony. What type of evidence are the server logs?
A.
Real evidence
B.
Documentary evidence
C.
Parole evidence
D.
Testimonial evidence
15.
If you need to confiscate a PC from a suspected attacker who does not work for your 
organization, what legal avenue is most appropriate?
A.
Consent agreement signed by employees.
B.
Search warrant.
C.
No legal avenue is necessary.
D.
Voluntary consent.
16.
Why should you avoid deleting log files on a daily basis?
A.
An incident may not be discovered for several days and valuable evidence could be lost.
B.
Disk space is cheap, and log files are used frequently.
C.
Log files are protected and cannot be altered.
D.
Any information in a log file is useless after it is several hours old.