In order to be able to successfully prosecute an intruder:
A.
A point of contact should be designated to be responsible for communicating with law enforcement and
other external agencies.
B.
A proper chain of custody of evidence has to be preserved.
C.
Collection of evidence has to be done following predefined procedures.
D.
Whenever possible, analyze a replica of the compromised resource, not the original, thereby avoiding
inadvertently tamping with evidence.
Explanation:
When evidence is seized, it is important to make sure a proper chain of custody is maintained to ensure any
data collected can later be properly and accurately represented in case it needs to be used for later events such
as criminal proceedings and a successful prosecution.
Incorrect Answers:
A: To successfully prosecute an intruder you do not need a designed point of contact. You need proper chain of
custody of evidence.
C: To successfully prosecute an intruder you do not to follow predefined procedures. You need proper chain of
custody of evidence.
D: It is import to make a replica of digital evidence to avoid tamping with evidence, though it is not strictly
required to make a successfully prosecution.Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 248