Evidence Collection
1. As a security administrator, if you believe that suspicious activity may be taking place, explain at what point you become concerned about the chain of custody for potential evidence. What steps might you take?
2. Describe the approach necessary to ensure that all evidence is gathered properly and that the chain of custody has been maintained. Then, evaluate which step in the outlined approach is the most likely to be skipped or not executed properly.