Learn how to answer a CISA exam question about the factors that affect the admissibility of digital forensic evidence in court. Get expert tips and explanations.
Table of Contents
Question
Which of the following would lead an IS auditor to conclude that the evidence collected during a digital forensic investigation would not be admissible in court?
A. The logs failed to identify the person handling the evidence.
B. The person who collected the evidence is not qualified to represent the case.
C. The evidence was not fully backed up using a cloud-based solution prior to the trial.
D. The evidence was collected by the internal forensics team.
Answer
A. The logs failed to identify the person handling the evidence.
Explanation
The logs that track the chain of custody of the evidence are essential to prove its integrity and authenticity in court. If the logs failed to identify the person handling the evidence, it would raise doubts about the reliability and validity of the evidence. Therefore, option A would lead an IS auditor to conclude that the evidence is not admissible in court.
Options B, C, and D are not correct because they are not directly related to the admissibility of the evidence. The qualification of the person who collected the evidence, the backup method of the evidence, and the source of the evidence are not sufficient grounds to reject the evidence in court, as long as the evidence is properly preserved, documented, and authenticated.
Reference
Isaca Certified Information Systems Auditor CISA certification exam practice question and answer (Q&A) dump with detail explanation and reference available free, helpful to pass the Isaca Certified Information Systems Auditor CISA exam and earn Isaca Certified Information Systems Auditor CISA certification.