Which forensics principle requires documenting every transfer of evidence custody from collection to presentation?
A CISSP practice question covering Domain 7: Security Operations. Try answering before reading the explanation below.
Show options & answer
Why "Chain of custody" is the right answer
Chain of custody documents who handled evidence, when, and why — a break invalidates evidence in court. Best evidence prefers originals. Hearsay is generally inadmissible second-hand testimony. Locard's exchange principle is a forensic concept about traces.
Study videos for this topic
Want to go deeper on Domain 7? Watch the full breakdown — every video is free, no account, no upsell.
Take the full CISSP practice test
120 questions, instant explanations, study-video links on every miss. No account.