At a bank, the original firewall log is still stored on the appliance, and the incident ticket holds a screenshot of that same log. Which item is best evidence of what the firewall recorded?
Select an answer to reveal the explanation.
Short Explanation
A photo of a receipt is not the receipt in the drawer. You treat the firewall log that is still on the appliance as best evidence, and the ticket screenshot is only a picture of it. The trap is promoting a screenshot, a rumor, or a rewritten summary into the original.
Full Explanation
Best evidence is the original record, the one the system created, not a later depiction of it. The firewall log is still on the appliance that generated it, so that log is the best evidence of what the firewall recorded. The item that fits is The original firewall log that is still stored on the appliance that generated the event. A screenshot can help someone read the text quickly, and it is a copy that can be cropped or altered, so it does not outrank the original. The screenshot pasted into the ticket, treated as the best record of the firewall event confuses a picture of the log with the log itself. A help-desk rumor about the firewall, treated as the best record of the firewall event is an unverified account, not a record the appliance wrote. A rewritten summary in the ticket, treated as the best record of the firewall event is a paraphrase and can drop or change lines. Exam caveat: best evidence is the original record, and a clear screenshot can still support the case without becoming that original. Operational check: preserve the log from the appliance, hash the copy you work from, and note in the ticket that the screenshot is a reference rather than the source record.