Free Preparation Discussions
MENU
EC-Council 212-89 Exam - Topic 1 Question 96 Discussion
Topic #: 1
Logan, an incident handler, ensures the chain of custody is documented while handling backup media post-attack. The goal is to preserve evidence integrity while restoring critical systems. Which recovery principle is Logan adhering to?
The EC-Council Incident Handler (ECIH) curriculum stresses the importance of maintaining evidence integrity during recovery operations. Documenting the chain of custody ensures that evidence remains admissible in legal proceedings and maintains forensic validity.
Chain of custody documentation tracks who handled the evidence, when it was accessed, how it was stored, and what actions were performed. This aligns directly with forensic compliance principles, which require proper evidence preservation, documentation, and controlled handling procedures.
While restoring systems, responders must ensure that backup media and affected systems are handled in a way that does not compromise evidence. ECIH emphasizes that recovery should not destroy or contaminate forensic artifacts that may be required for legal, regulatory, or disciplinary action.
Option B (Network segmentation) relates to containment strategies. Option C (Immutable infrastructure) refers to architectural resilience models. Option D (Enhanced authentication) concerns access control, not evidence handling.
Therefore, Logan is adhering to forensic compliance principles during recovery.
Theron
20 days agoMiles
25 days agoGeoffrey
1 month agoFranklyn
1 month agoLeonor
1 month agoBelen
2 months agoAndra
2 months agoRefugia
2 months agoOna
2 months agoRyan
2 months agoWenona
2 months agoKaycee
3 months agoMartina
3 months agoHerman
3 months agoViola
3 months ago