Discuss ISC2 CISSP Exam Topic 5 Question 108

Which of the following describes the order in which a digital forensic process is usually conducted?

AAscertain legal authority, agree upon examination strategy, conduct examination, and report results

BAscertain legal authority, conduct investigation, report results, and agree upon examination strategy

CAgree upon examination strategy, ascertain legal authority, conduct examination, and report results

DAgree upon examination strategy, ascertain legal authority, report results, and conduct examination

Suggested Answer: A

The digital forensic process is usually conducted in the following order: ascertain legal authority, agree upon examination strategy, conduct examination, and report results. This order ensures that the forensic process is lawful, ethical, and effective. The first step is to ascertain legal authority, which means to verify that the forensic examiner has the proper authorization, consent, or warrant to perform the examination. This step is crucial to avoid violating any laws or privacy rights of the data owner or custodian. The second step is to agree upon examination strategy, which means to define the scope, objectives, and methods of the examination. This step is important to establish the expectations, roles, and responsibilities of the forensic examiner and the client or stakeholder. The third step is to conduct examination, which means to collect, preserve, analyze, and document the digital evidence. This step is essential to perform the forensic tasks in a systematic, accurate, and reliable manner. The fourth step is to report results, which means to present the findings, conclusions, and recommendations of the examination. This step is necessary to communicate the forensic outcomes in a clear, concise, and understandable way.Reference:CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6: Security Assessment and Testing, p. 545-546.Official (ISC)2 CISSP CBK Reference, Fifth Edition, Domain 6: Security Assessment and Testing, p. 688-689.

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

30 comments · newest first

Rodney 6 months ago

A is clear and structured. Makes sense for a forensic process.

Kiley 6 months ago

D is definitely wrong. You can't report before conducting the examination!

Cathrine 6 months ago

C feels off. Strategy should come after legal authority, right?

Rosita 6 months ago

I’m not so sure. B seems logical too, but it skips the strategy part.

Viola 7 months ago

I think A is the right order. Legal authority first!

Corrina 7 months ago

I’m surprised this is the standard process!

Leah 7 months ago

I thought B) was right at first, but A) is clearer.

Edison 8 months ago

Wait, why is legal authority first? Seems odd.

Izetta 8 months ago

Totally agree, A) makes the most sense.

Talia 8 months ago

A) is the correct order!

Nathalie 8 months ago

Haha, these options are like a game of digital forensic Twister. Better get the order right or you'll end up in a tangled mess!

Jaime 8 months ago

B) Ascertain legal authority, conduct investigation, report results, and agree upon examination strategy - Wait, what? That's completely backwards!

Arminda 8 months ago

D) Agree upon examination strategy, ascertain legal authority, report results, and conduct examination - Hmm, I don't think that's the right order. Gotta get the legal stuff sorted first.

Novella 9 months ago

C) Agree upon examination strategy, ascertain legal authority, conduct examination, and report results - Sounds about right, but I'm not 100% sure.

Jesse 9 months ago

I’m leaning towards A too, but I keep second-guessing myself. The order seems critical, and I just hope I remember it right!

Jolene 9 months ago

I feel like I might be mixing up the order. Was it B that had the investigation before the strategy? That seems off to me.

Jolene 9 months ago

Hmm, I'm leaning towards option C. That seems to match the order I remember learning about in class. But I'll double-check my understanding just to be sure.

Laurene 9 months ago

This seems straightforward. The correct order is A - ascertain legal authority, agree on strategy, conduct exam, report results. I'm confident that's the right answer.

Oretha 9 months ago

I'm a bit unsure about the order here. I'll have to carefully consider each option and see which one matches what I know about the digital forensic process.

Justine 10 months ago

A) Ascertain legal authority, agree upon examination strategy, conduct examination, and report results - This is the correct order for a digital forensic process.

Matthew 10 months ago

I remember practicing a question like this, and I think it was A. It makes sense to have a strategy before diving into the examination.

Raina 10 months ago

I think the first step should definitely be about legal authority, but I'm not sure if it comes before or after the examination strategy.

Catarina 10 months ago

Agreed! Without legal authority, everything else falls apart.

Cherry 11 months ago

Okay, let me think this through. I know the steps usually involve getting legal approval, planning the investigation, actually conducting the examination, and then reporting the findings.

Kenny 11 months ago

Hmm, I think the key here is understanding the typical digital forensic process. I'll need to review my notes on that.

Kanisha 5 months ago

↳ replying to Kenny

I think we all agree that legal authority is crucial first.

Kindra 5 months ago

↳ replying to Kenny

I’m leaning towards option C. Strategy first, then authority?

Art 6 months ago

↳ replying to Kenny

Yeah, starting with legal authority makes sense.

Val 6 months ago

↳ replying to Kenny

I believe option A is the most logical sequence.

Denise 10 months ago

↳ replying to Kenny

Option A is definitely the standard approach.

ISC2 CISSP Exam - Topic 5 Question 108 Discussion