hardMultiple ChoiceObjective-mapped
200-201 Practice Question: MedSecure is a healthcare organization with a…
MedSecure is a healthcare organization with a security policy that requires all security incidents to be handled following the NIST framework. A system administrator discovers that an unauthorized user has accessed a database containing patient records. The administrator immediately disconnects the server from the network. The security analyst is called to investigate. The analyst finds that the server was not part of the centralized logging system, and the only logs available are the database audit logs. The security policy mandates preservation of evidence and chain of custody. The analyst needs to collect the database audit logs. Which action should the analyst take to ensure proper evidence collection?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process
Creating a bit-for-bit copy of the audit log files using a forensic tool, hashing both the original and copy, and documenting the process ensures data integrity and maintains chain of custody. This method preserves the original evidence and provides verifiable proof that the copy is identical. Option B (emailing CSV) compromises integrity and lacks chain of custody. Option C (full disk image) is excessive for collecting only log files and may introduce unnecessary complexity. Option D (copy to USB) does not use forensic tools or proper documentation, failing to preserve integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Make a bit-for-bit copy of the audit log files using a forensic tool, hash the original and copy, and document the process
Why this is correct
This ensures integrity, authenticity, and proper chain of custody.
- ✗
Export the logs to a CSV file and email them to the security team
Why it's wrong here
Exporting may alter metadata and fails to preserve integrity.
- ✗
Use a write-blocker to create a forensic image of the entire hard drive
Why it's wrong here
While forensic, it's excessive for log collection and time-consuming.
- ✗
Copy the audit logs to a USB drive and store it in a locked drawer
Why it's wrong here
No integrity verification or chain of custody documentation.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.