Delegation is the forwarding of a request by one object to another object.
Answer Polyresponse is a distracter.
Polyinstantiationis the development of a detailed version
of an object from another object. The new object uses values that are
different from those in the original object.

* Answer "All risks to an information system are eliminated" is incorrect because all risks to information systems cannot be eliminated
* answer "Other management personnel are delegated the responsibility for information system security" is incorrect because senior management cannot delegate its responsibility for information system security under due care
* answer "The cost of implementing safeguards is greater than the potential resultant losses resulting from information security breaches" is incorrect because the cost of implementing safeguards should be less than or equal to the potential resulting losses relative to the exercise of due care.

Making a copy of the hard drive should be the first action to protect the chain of evidence when a desktop computer is involved. A chain of evidence, also known as a chain of custody, is a process that documents and preserves the integrity and authenticity of the evidence collected from a crime scene, such as a desktop computer. A chain of evidence should include information such as:
* The identity and role of the person who collected, handled, or transferred the evidence
* The date and time of the collection, handling, or transfer of the evidence
* The location and condition of the evidence
* The method and tool used to collect, handle, or transfer the evidence
* The signature or seal of the person who collected, handled, or transferred the evidence Making a copy of the hard drive should be the first action to protect the chain of evidence when a desktop computer is involved, because it can ensure that the original hard drive is not altered, damaged, or destroyed during the forensic analysis, and that the copy can be used as a reliable and admissible source of evidence.
Making a copy of the hard drive should also involve using a write blocker, which is a device or a software that prevents any modification or deletion of the data on the hard drive, and generating a hash value, which is a unique and fixed identifier that can verify the integrity and consistency of the data on the hard drive.
The other options are not the first actions to protect the chain of evidence when a desktop computer is involved, but rather actions that should be done after or along with making a copy of the hard drive. Taking the computer to a forensic lab is an action that should be done after making a copy of the hard drive, because it can ensure that the computer is transported and stored in a secure and controlled environment, and that the forensic analysis is conducted by qualified and authorized personnel. Starting documenting is an action that should be done along with making a copy of the hard drive, because it can ensure that the chain of evidence is maintained and recorded throughout the forensic process, and that the evidence can be traced and verified.
Turning off the computer is an action that should be done after making a copy of the hard drive, because it can ensure that the computer is powered down and disconnected from any network or device, and that the computer is protected from any further damage or tampering.

All the previous protocols operate at the transport layer except for Secure
HTTP (S-HTTP), which operates at the application layer. S-HTTP has been replaced by
SSL and TLS.
As it is very well explained in the Shon Harris book:
The transport layer receives data from many different applications and assembles the data into a stream to be properly transmitted over the network. The main protocols that work at this layer are TCP, UDP, Secure Sockets Layer (SSL), and Sequenced Packet Exchange
(SPX).
NOTE:
Different references can place specific protocols at different layers. For example, many references place the SSL protocol in the session layer, while other references place it in the transport layer. It is not that one is right or wrong. The OSI model tries to draw boxes around reality, but some protocols straddle the different layers. SSL is made up of two protocols- one works in the lower portion of the session layer and the other works in the transport layer.
For purposes of the CISSP exam, SSL resides in the transport layer.
Reference(s) used for this question:
Harris, Shon (2012-10-18). CISSP All-in-One Exam Guide, 6th Edition (p. 526). McGraw-
Hill. Kindle Edition.