Explanation/Reference:
Explanation:
A chain of custody is a history that shows how evidence was collected, analyzed, transported, and preserved in order to be presented in court. Because electronic evidence can be easily modified, a clearly defined chain of custody demonstrates that the evidence is trustworthy.
Incorrect Answers:
A: The legal aspect is not the most important factor to chain of custody. A history of how the evidence was handled is more important.
B: When evidence is collected contact and advice from law enforcement officials. A history of how the evidence was handled is more important.
D: Specifics of how to handle log files are not the most critical factor to establish a chain of custody. . A history of how the evidence was handled is more important.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 1050

Section: Software Development Security

Explanation/Reference:
Explanation:
The three-step handshake a TCP connection goes through is SYN, SYN/ACK, and ACK.
Incorrect Answers:
A: The initiate a TCP connection the handshake must start with a SYN, not with an ACK.
C: The initiate a TCP connection the handshake must start with a SYN, followed by a SYN/ACK. The second step in the handshake is not SYN.
D: The initiate a TCP connection the handshake must start with a SYN, not with an ACK.

Explanation/Reference:
Explanation:
802.11 is a set specifications for implementing wireless local area network (WLAN) computer communication.
Incorrect Answers:
A: The 802.11 standard is not for PKI. It is a specification for wireless communication on a LAN.
C: The 802.11 standard does not concern packet-switching. It is a specification for wireless communication on a LAN.
D: The 802.11 standard is not related to the OSI model or the ISO model. The 802.11 standard relates to wireless communication on a LAN.
References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 715

A logic bomb is malicious code intentionally inserted into a system that remains inactive until a specific triggering condition is met (such as a particular date, the deletion of an employee record, or a specific user action), at which point it executes its malicious payload.