A security analyst is investigating a workstation that is suspected of being compromised. The analyst has disconnected the network cable and created a forensic image of the hard drive using a write-blocker. Which of the following should the analyst do NEXT to preserve evidence integrity?

Reconnect the workstation to the network to check for active connections

Reconnecting could alter the state of the system, introduce network evidence, or trigger malicious activity, compromising the evidence chain of custody.

Run antivirus software on the original drive

Scanning the original drive could modify file access times or other metadata, and may trigger malware that alters the system state. Analysis should be performed on the image, not the original.

Delete any suspicious files found on the image

Forensic analysis requires preserving the original data. Deleting files from the image would destroy potential evidence and could be considered spoliation.

What does this 220-1101 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Verify the hash of the forensic image against the original drive — After creating a forensic image, the next critical step is to verify its integrity by computing a hash (e.g., MD5, SHA-1) of the original drive and the image file and ensuring they match. This proves that the image is an exact copy and no data has been altered. Reconnecting to the network, scanning the original drive, or deleting files would contaminate evidence.

What should I do if I get this 220-1101 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.