Questions: During an investigation into a cybersecurity incident, what steps should the organization take to ensure that host devices and media taken from the crime scene are properly labeled, bagged, and sealed? A. Label the devices and media with a permanent marker, place them in a plastic bag, and seal them with duct tape B. Label the devices and media with tamper-evident, antistatic shielding bags, and record evidence collection details on a chain of custody form C. Place the devices and media in a cardboard box, seal it with masking tape, and store it in a locked cabinet D. Label the devices and media with a ballpoint pen, place them in a manila envelope, and seal them with staples

The answer is the second one (B): Label the devices and media with tamper-evident, antistatic shielding bags, and record evidence collection details on a chain of custody form.

Explanation for each option:

A. Label the devices and media with a permanent marker, place them in a plastic bag, and seal them with duct tape

• This option is incorrect because using a permanent marker and plastic bags does not provide adequate protection against tampering or static damage. Duct tape is also not a secure sealing method for evidence.

B. Label the devices and media with tamper-evident, antistatic shielding bags, and record evidence collection details on a chain of custody form

• This option is correct because tamper-evident bags help ensure the integrity of the evidence, antistatic shielding bags protect electronic devices from static damage, and maintaining a chain of custody form is crucial for tracking the evidence and ensuring its admissibility in legal proceedings.

C. Place the devices and media in a cardboard box, seal it with masking tape, and store it in a locked cabinet

• This option is incorrect because cardboard boxes and masking tape do not provide adequate protection against tampering or environmental damage. While storing in a locked cabinet is a good practice, it is not sufficient on its own.

D. Label the devices and media with a ballpoint pen, place them in a manila envelope, and seal them with staples

• This option is incorrect because a ballpoint pen may not provide a clear or permanent label, and manila envelopes and staples do not offer sufficient protection against tampering or environmental damage.

Summary: To ensure that host devices and media taken from a crime scene are properly labeled, bagged, and sealed, the organization should use tamper-evident, antistatic shielding bags and record evidence collection details on a chain of custody form. This approach helps maintain the integrity and security of the evidence.