200-201 Security Policies and Procedures Practice Question
A security analyst is investigating a potential data breach. They need to preserve evidence for legal proceedings. Which action should the analyst take to ensure the integrity of the data?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a write blocker when creating a forensic image
Write-blocking ensures original data is not altered during forensic acquisition.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run antivirus scans on the affected system
Why it's wrong here
Scanning might modify files or logs.
- ✓
Use a write blocker when creating a forensic image
Why this is correct
Write blockers prevent any writes to the source drive.
- ✗
Delete suspicious files to contain the threat
Why it's wrong here
Deleting evidence can destroy forensic value.
- ✗
Copy files to a network share without write protection
Why it's wrong here
This could alter timestamps and data integrity.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 979-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.