Q). Which one of the following types of backups is going to be of most use for forensic purposes?

A. Tape archive of files.
B. Dump of file system.
C. Device to Device copy.
D. Dump of memory store.

Answer: The correct answer is "C". For forensic purposes, it is very important to get a complete backup of the disk drive. A device to device copy reads data block-by-block. It copies even the files which have been deleted. A device to device copy is thus the most effective approach for forensic purposes.

Related CISM questions

Establishing Security Baselines
Deploying a Honeypot
Social Engineering Attacks
Metrics for Information Security Program