Question: Which of the following is the MOST critical consideration when collecting and preserving admissible evidence during an incident response?
A.) Unplugging the systems
B.) Chain of custody
C.) Separation of duties
D.) Clock synchronization

Download pdf (with explanations) edition of this exam.