Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

ISC2 CISSP Exam - Topic 5 Question 108 Discussion

Which of the following describes the order in which a digital forensic process is usually conducted?
A) Ascertain legal authority, agree upon examination strategy, conduct examination, and report results
B) Ascertain legal authority, conduct investigation, report results, and agree upon examination strategy
C) Agree upon examination strategy, ascertain legal authority, conduct examination, and report results
D) Agree upon examination strategy, ascertain legal authority, report results, and conduct examination

ISC2 CISSP Exam - Topic 5 Question 108 Discussion

Actual exam question for ISC2's CISSP exam
Question #: 108
Topic #: 5
[All CISSP Questions]

Which of the following describes the order in which a digital forensic process is usually conducted?

Show Suggested Answer Hide Answer
Suggested Answer: A

The digital forensic process is usually conducted in the following order: ascertain legal authority, agree upon examination strategy, conduct examination, and report results. This order ensures that the forensic process is lawful, ethical, and effective. The first step is to ascertain legal authority, which means to verify that the forensic examiner has the proper authorization, consent, or warrant to perform the examination. This step is crucial to avoid violating any laws or privacy rights of the data owner or custodian. The second step is to agree upon examination strategy, which means to define the scope, objectives, and methods of the examination. This step is important to establish the expectations, roles, and responsibilities of the forensic examiner and the client or stakeholder. The third step is to conduct examination, which means to collect, preserve, analyze, and document the digital evidence. This step is essential to perform the forensic tasks in a systematic, accurate, and reliable manner. The fourth step is to report results, which means to present the findings, conclusions, and recommendations of the examination. This step is necessary to communicate the forensic outcomes in a clear, concise, and understandable way.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6: Security Assessment and Testing, p. 545-546.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 6: Security Assessment and Testing, p. 688-689.


by Freeman at Nov 20, 2025, 12:15 AM

Limited Time Offer

25%

Off

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Rodney
3 months ago
A is clear and structured. Makes sense for a forensic process.
upvoted 0 times
...
Kiley
3 months ago
D is definitely wrong. You can't report before conducting the examination!
upvoted 0 times
...
Cathrine
3 months ago
C feels off. Strategy should come after legal authority, right?
upvoted 0 times
...
Rosita
3 months ago
I’m not so sure. B seems logical too, but it skips the strategy part.
upvoted 0 times
...
Viola
4 months ago
I think A is the right order. Legal authority first!
upvoted 0 times
...
Corrina
4 months ago
I’m surprised this is the standard process!
upvoted 0 times
...
Leah
4 months ago
I thought B) was right at first, but A) is clearer.
upvoted 0 times
...
Edison
5 months ago
Wait, why is legal authority first? Seems odd.
upvoted 0 times
...
Izetta
5 months ago
Totally agree, A) makes the most sense.
upvoted 0 times
...
Talia
5 months ago
A) is the correct order!
upvoted 0 times
...
Nathalie
5 months ago
Haha, these options are like a game of digital forensic Twister. Better get the order right or you'll end up in a tangled mess!
upvoted 0 times
...
Jaime
5 months ago
B) Ascertain legal authority, conduct investigation, report results, and agree upon examination strategy - Wait, what? That's completely backwards!
upvoted 0 times
...
Arminda
5 months ago
D) Agree upon examination strategy, ascertain legal authority, report results, and conduct examination - Hmm, I don't think that's the right order. Gotta get the legal stuff sorted first.
upvoted 0 times
...
Novella
6 months ago
C) Agree upon examination strategy, ascertain legal authority, conduct examination, and report results - Sounds about right, but I'm not 100% sure.
upvoted 0 times
...
Jesse
6 months ago
I’m leaning towards A too, but I keep second-guessing myself. The order seems critical, and I just hope I remember it right!
upvoted 0 times
...
Jolene
6 months ago
I feel like I might be mixing up the order. Was it B that had the investigation before the strategy? That seems off to me.
upvoted 0 times
...
Jolene
6 months ago
Hmm, I'm leaning towards option C. That seems to match the order I remember learning about in class. But I'll double-check my understanding just to be sure.
upvoted 0 times
...
Laurene
6 months ago
This seems straightforward. The correct order is A - ascertain legal authority, agree on strategy, conduct exam, report results. I'm confident that's the right answer.
upvoted 0 times
...
Oretha
6 months ago
I'm a bit unsure about the order here. I'll have to carefully consider each option and see which one matches what I know about the digital forensic process.
upvoted 0 times
...
Justine
7 months ago
A) Ascertain legal authority, agree upon examination strategy, conduct examination, and report results - This is the correct order for a digital forensic process.
upvoted 0 times
...
Matthew
7 months ago
I remember practicing a question like this, and I think it was A. It makes sense to have a strategy before diving into the examination.
upvoted 0 times
...
Raina
7 months ago
I think the first step should definitely be about legal authority, but I'm not sure if it comes before or after the examination strategy.
upvoted 0 times
...
Catarina
7 months ago
Agreed! Without legal authority, everything else falls apart.
upvoted 0 times
...
Cherry
8 months ago
Okay, let me think this through. I know the steps usually involve getting legal approval, planning the investigation, actually conducting the examination, and then reporting the findings.
upvoted 0 times
...
Kenny
8 months ago
Hmm, I think the key here is understanding the typical digital forensic process. I'll need to review my notes on that.
upvoted 0 times
Kanisha
2 months ago
I think we all agree that legal authority is crucial first.
upvoted 0 times
...
Kindra
2 months ago
I’m leaning towards option C. Strategy first, then authority?
upvoted 0 times
...
Art
3 months ago
Yeah, starting with legal authority makes sense.
upvoted 0 times
...
Val
3 months ago
I believe option A is the most logical sequence.
upvoted 0 times
...
Denise
7 months ago
Option A is definitely the standard approach.
upvoted 0 times
...
...

Save Cancel