Security Policies and Procedures →mediumMultiple ChoiceObjective-mapped

200-201 Security Policies and Procedures Practice Question

A SOC analyst is investigating a suspected data exfiltration. The analyst needs to preserve evidence from a compromised workstation. Which of the following is the CORRECT procedure to ensure evidence integrity?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a write-blocker, compute hash of original disk, create image, compute hash of image, and compare hashes.

Proper evidence preservation requires hashing the original disk before imaging and then hashing the image to verify integrity.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use a write-blocker, compute hash of original disk, create image, compute hash of image, and compare hashes.
Why this is correct
This ensures the image is an exact copy.
✗
Create a forensic image without write-blocking, then hash the image.
Why it's wrong here
Write-blocking is essential to prevent alteration.
✗
Copy all files to an external drive without hashing.
Why it's wrong here
File copy does not preserve the entire disk or metadata.
✗
Disconnect the hard drive and boot from a live CD to collect data.
Why it's wrong here
This may alter evidence without write-blocking.

Go deeper

200-201 Security Policies and Procedures Practice Question

Why each option matters

Option-by-option breakdown

Related to this question