CISM Certified Information Security Manager – Question1360

Which of the following would represent a violation of the chain of custody when a backup tape has been identified as evidence in a fraud investigation? The tape was:

A.
removed into the custody of law enforcement investigators.
B. kept in the tape library' pending further analysis.
C. sealed in a signed envelope and locked in a safe under dual control.
D. handed over to authorized independent investigators.

Correct Answer: B

Explanation:

Explanation: Since a number of individuals would have access to the tape library, and could have accessed and tampered with the tape, the chain of custody could not be verified. All other choices provide clear indication of who was in custody of the tape at all times.