200-201 Security Policies and Procedures Practice Question
A security analyst is reviewing the chain of custody form for a laptop seized from an employee suspected of intellectual property theft. The form shows the laptop was collected by the IT manager, transported to a storage room, and later examined by an outside forensics firm. The analyst notices that the form lacks signatures for the transfer between the IT manager and the storage room custodian. What is the most likely impact of this omission on the investigation?
⚠ Common exam trap
The trap here is assuming that any chain of custody error makes evidence automatically inadmissible, when in reality it typically affects the weight or credibility of the evidence rather than causing automatic exclusion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The evidence may be challenged as tampered or unauthenticated in legal proceedings.
A chain of custody is a chronological documentation of evidence seizure, custody, transfer, and analysis. Each transfer must be signed and dated to prove the evidence was not tampered with. Missing signatures create an unaccounted period, which undermines the evidence's authenticity. Courts may exclude or discount such evidence, so the correct impact is that it may be challenged as tampered or unauthenticated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The outside forensics firm must re-examine the laptop from scratch to restore integrity.
Why it's wrong here
Re-examination does not retroactively fix a chain of custody gap. The original collection and transfer records remain incomplete. While a new examination could produce additional findings, it cannot restore the unbroken documentation required for the original evidence. This option misunderstands that chain of custody is about documentation, not the forensic process itself.
- ✗
The forensic examination results will be automatically inadmissible in court.
Why it's wrong here
Inadmissibility is not automatic; the opposing party must raise the issue and the judge decides. A gap in chain of custody typically affects the weight of the evidence, not automatic exclusion. The forensic firm's results may still be admitted if the gap is explained or if other evidence corroborates. This option overstates the consequence and ignores judicial discretion.
- ✗
The IT manager will be held personally liable for any data loss from the laptop.
Why it's wrong here
Personal liability is not a direct consequence of a chain of custody documentation gap. Liability would depend on company policies, employment contracts, and whether negligence caused actual harm. The scenario focuses on evidentiary integrity, not personal financial responsibility. This distractor confuses legal evidence handling with HR or civil liability issues.
- ✓
The evidence may be challenged as tampered or unauthenticated in legal proceedings.
Why this is correct
A complete chain of custody requires documented, signed transfers at every handoff. Missing signatures for the IT manager to storage room transfer creates a gap where unauthorized access or tampering could have occurred. This weakens the evidence's admissibility and credibility. In legal proceedings, opposing counsel can argue the evidence was not properly controlled, potentially leading to exclusion or reduced weight.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.