An administrator responded to an incident where an employee copied financial data to a portable hard drive and then left the company with the data. The administrator documented the movement of the evidence. Which of the following concepts did the administrator demonstrate?
The administrator demonstrated the concept of preserving chain of custody. Chain of custody refers to maintaining a documented history or paper trail of the evidence's handling, which is crucial to prevent tampering or mishandling and to ensure evidence integrity. Documenting the movement of the evidence, such as the portable hard drive with financial data, is an essential part of this process.
The answer is C, because the administrator is responding to an incident which is data breach.
A. Preserving chain of custody The administrator demonstrated the concept of preserving the chain of custody by documenting the movement of the evidence, which, in this case, involves the financial data copied to a portable hard drive. Explanation: Preserving chain of custody (Option A): Chain of custody refers to the chronological documentation or paper trail showing the collection, transfer, control, analysis, and disposition of physical or electronic evidence. By documenting the movement of the evidence (the financial data on the portable hard drive), the administrator is ensuring