hardMultiple Choice
200-201 Practice Question: During an incident, a first responder pulls the…
During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?
⚠ Common exam trap
Test-takers frequently confuse the different incident response procedures. Candidates might choose Chain of Custody because it sounds related to evidence, but the specific violation is about preserving volatile data, which falls under evidence preservation, not chain of custody.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident Response Procedure for evidence preservation
Pulling the network cable of a compromised server causes the loss of volatile data such as running processes, memory contents, and network connections. The Incident Response Procedure for evidence preservation dictates that volatile data must be collected before any action that could destroy it. By pulling the cable, the first responder violated this procedure, leading to the inability to collect volatile evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Chain of Custody Procedure
Why it's wrong here
Pulling the cable destroyed volatile evidence such as running processes and memory contents; the violated procedure governs evidence preservation and order of volatility, not custody documentation. Chain of custody tracks who handled evidence after collection. It applies once artefacts are seized, not when live data is lost.
- ✓
Incident Response Procedure for evidence preservation
Why this is correct
Pulling the network cable removed power-dependent state before capture, destroying running processes and memory-resident artefacts. The evidence preservation procedure requires collecting volatile data in order of volatility before any containment action. Isolating the host via network-level controls instead would have preserved that volatile evidence while still containing the compromise.
- ✗
Forensic Analysis Procedure
Why it's wrong here
Forensic analysis procedure governs how evidence is gathered and preserved, but the failure here is that volatile data was destroyed before acquisition, not that analysis was performed incorrectly. It would be the right answer if the team had collected data properly yet analysed it unsoundly.
- ✗
Escalation Procedure
Why it's wrong here
Escalation procedure defines when and to whom an incident is reported, not how the responder handles the host. Pulling the cable is a containment action, so escalation was not the violated control; it would apply if the responder had failed to notify the on-call team within the required timeframe.
Go deeper
Related to this question
About these practice questions
One of 968 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.