hardMultiple ChoiceObjective-mapped
200-201 Practice Question: During an incident, a first responder pulls the…
During an incident, a first responder pulls the network cable of a compromised server. Later, the incident response team is unable to collect volatile data such as running processes. Which policy or procedure was violated?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Incident Response Procedure for evidence preservation
Incident response procedures typically require preserving volatile data before disconnecting the system. By pulling the network cable first, the first responder violated the evidence preservation steps, making option B the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Chain of Custody Procedure
Why it's wrong here
Chain of custody documents evidence handling, not collection order.
- ✓
Incident Response Procedure for evidence preservation
Why this is correct
Immediate disconnection prevented capture of volatile data.
- ✗
Forensic Analysis Procedure
Why it's wrong here
Forensic analysis happens after acquisition.
- ✗
Escalation Procedure
Why it's wrong here
Escalation is about notifying stakeholders.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.