200-201 Security Policies and Procedures Practice Question
An incident handler needs to preserve a hard drive from a compromised system. Which two actions are essential to maintain the integrity of the evidence?
⚠ Common exam trap
Cisco often tests the misconception that a Faraday bag preserves data integrity, when in fact it only prevents remote communication; the trap is confusing physical isolation (Faraday bag) with write protection (write blocker).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a write blocker when creating the forensic image
A write blocker prevents any writes to the original drive, preserving its integrity during imaging. Option D is correct because computing a cryptographic hash (e.g., SHA-256) of the original drive before imaging creates a digital fingerprint that can be used later to verify that the forensic image is an exact copy and that no alterations occurred during acquisition or analysis. Both actions are essential to maintain evidence integrity and admissibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the original drive in a Faraday bag
Why it's wrong here
Faraday bags prevent wireless communication but are not essential for integrity.
- ✗
Copy files directly to an external drive using the operating system
Why it's wrong here
Direct copying may alter metadata and is not forensically sound.
- ✓
Use a write blocker when creating the forensic image
Why this is correct
A hardware or software write blocker intercepts write commands at the interface level, so the imaging tool reads the drive without altering a single sector. This preserves the original media's integrity, satisfying the requirement that evidence remain unmodified during acquisition.
- ✓
Compute a cryptographic hash of the original drive before imaging
Why this is correct
Hashing the original drive with SHA-256 before imaging produces a baseline digest. Re-hashing the resulting image and matching values proves bit-for-bit fidelity, satisfying the integrity requirement by demonstrating the copy is forensically identical to the source.
- ✗
Boot the system from the hard drive to collect volatile data
Why it's wrong here
Booting the system modifies the drive, compromising integrity.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.