CompTIA CySA+ CS0-003 Practice Question
During an incident response, which action is MOST critical to maintain the integrity of the evidence?
Securing physical evidence in a tamper-proof container
Ensuring the chain of custody is maintained
Documenting timestamps of all collected evidence
Using write blockers to prevent alteration of digital evidence