Free ISACA CISA Actual Exam Questions - Question 1 Discussion

A/B? Imaging (A) definitely preserves the data, but powering down (B) can sometimes be necessary to prevent ongoing damage or changes. Still, B risks losing volatile data, so A feels safer overall.

Option A makes the most sense here since imaging creates an exact copy of the data right away, preventing loss or modification. Powering down (B) or rebooting (D) can change or erase volatile info, so they’re risky. While protecting hardware (C) is important to stop physical tampering, it doesn’t preserve the actual digital evidence like imaging does. So imaging is the best way to safeguard the data exactly as it was when found.

A—imaging captures all data quickly before it gets altered or lost.

A/C for me. Imaging preserves data, but hardware protection keeps evidence intact.

A/C? Imaging (A) is great, but if the hardware isn’t physically secured (C), someone could tamper with it before imaging. So protecting hardware is also crucial alongside imaging.

It’s A. Imaging captures the system state without altering original data, unlike powering down or rebooting which can change or erase evidence. Protecting hardware alone isn’t enough if data isn’t copied properly.

Does the question specify if the system is live or already powered off? That could change whether imaging or preserving hardware is best. Thoughts on that?