CompTIA CySA+ CS0-003 (V3) Practice Question

The correct answer is "To establish that the evidence has not been altered, tampered with, or otherwise compromised." A complete, continuous chain of custody provides a verifiable record of who handled the evidence, when, and under what conditions, thereby demonstrating its authenticity and integrity for legal or internal proceedings. Gaps in this documentation can cause a court-or an internal review-to reject the evidence. The other options describe activities that may occur during an investigation (analysis, remediation, or data backup) but are not the fundamental reason the chain of custody is maintained.