At an agency, every person who handled a disk image signed the time they received it and the time they released it. What does that set of signatures document?
Select an answer to reveal the explanation.
Short Explanation
A library card that shows who checked a book out, and when they brought it back, is a handling record. You are looking at chain of custody for the disk image. The trap is the attack-phase model, the asset list, or the TLS cipher suite.
Full Explanation
Chain of custody documents evidence handling: who received an item, when they received it, and when they released it. The signatures on this disk image are that handling record. They do not describe the adversary's phases, the owner of the workstation, or a TLS negotiation. "Chain of custody: who received the disk image, when they received it, and when they released it". Receive time and release time for each handler are the custody record for the image. "The attacker's kill chain, covering the phases from reconnaissance through actions on objectives". The kill chain orders adversary phases from reconnaissance through actions on objectives. Those phases are not the sign-in sheet for who held the image. "The asset inventory entry that names the imaged workstation and its agency owner". An inventory names the workstation and its owner. It does not record each person who took and returned the image. "The cipher suite negotiated the last time that agency host completed a TLS handshake". A cipher suite is the set of algorithms a TLS handshake selected. Handshake details are not evidence-handling signatures. Exam caveat: the word chain in the kill chain is the attack sequence, not custody. Mixing the two names is the usual miss. Operational check: walk the form and confirm each handler has a receive time and a release time, with the image hash noted so the copy's integrity can be shown.