hardMultiple Select
200-201 Practice Question: Which THREE actions are mandatory in the evidence…
Which THREE actions are mandatory in the evidence handling process according to standard forensic procedures?
⚠ Common exam trap
200-201 often tests the misconception that 'cleaning up' malware or rebooting to stabilize a system is helpful — in forensics, both actions destroy evidence and violate preservation principles.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Document the chain of custody
Option A is correct because documenting the chain of custody is mandatory in forensic procedures; it records who collected, handled, transferred, and stored the evidence, ensuring its integrity and admissibility in legal proceedings. Option C is correct because a write blocker must be used when imaging a device to prevent any modification of the original evidence, preserving its integrity for analysis. Option D is correct because creating a forensic image (a bit-for-bit copy) of the device is essential; it allows analysis to be performed on the copy while the original remains unaltered and preserved as evidence. Option B is incorrect because deleting malware would alter the evidence and destroy potentially valuable artifacts; malware should be preserved and analyzed, not removed. Option E is incorrect because rebooting the device can modify volatile memory, delete temporary files, and alter system state, which would compromise the evidence and violate forensic soundness.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Document the chain of custody
Why this is correct
Documenting the chain of custody records every transfer, handler and storage location of evidence, proving it was not tampered with. This is mandatory because unbroken custody documentation is what makes evidence admissible in legal or disciplinary proceedings.
- ✗
Delete any malware found immediately
Why it's wrong here
Deleting malware modifies the system and destroys artefacts needed for analysis, so it violates evidence preservation. It tempts because remediation feels responsible, and deletion is correct only after forensic imaging and documentation are finished and the investigation no longer requires the sample.
- ✓
Use a write blocker when imaging
Why this is correct
A write blocker enforces a hardware or software read-only block on the source drive during imaging, preventing any modification to the original evidence. This satisfies the forensic requirement to preserve data integrity and maintain an unbroken chain of custody, ensuring the acquired image remains an admissible, bit-for-bit replica.
- ✓
Create a forensic image of the device
Why this is correct
Creating a forensic image produces a bit-for-bit copy of the device, preserving the original for examination. This is mandatory because analysis must be performed on the copy, keeping the source evidence unaltered and available for verification.
- ✗
Reboot the device to clear temporary files
Why it's wrong here
Rebooting alters volatile memory and system state, destroying evidence rather than preserving it, so it breaches forensic procedure. It tempts as routine troubleshooting, and would be acceptable only once imaging and volatile-data capture are complete and the device is no longer needed.
Go deeper
Related to this question
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.