CompTIA CySA+ CS0-003 Practice Question
During an incident response, which action is MOST critical to maintain the integrity of the evidence?
Documenting timestamps of all collected evidence
Securing physical evidence in a tamper-proof container
Using write blockers to prevent alteration of digital evidence
Ensuring the chain of custody is maintained