hardMultiple Select
CS0-003 Practice Question: A responder is acquiring evidence from a…
A responder is acquiring evidence from a potentially compromised server. Which actions support forensic integrity? (Choose two.)
⚠ Common exam trap
The CS0-004 exam often tests the misconception that disabling logging helps preserve the integrity of the acquisition process, when in fact it destroys potential evidence and violates forensic best practices.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Calculate and record hashes of acquired images
Calculating and recording hashes (e.g., SHA-256) of acquired disk images ensures data integrity by providing a cryptographic fingerprint that can be used later to verify that the evidence has not been altered. This is a foundational step in forensic acquisition, as any modification to the image will produce a different hash, proving tampering or corruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Calculate and record hashes of acquired images
Why this is correct
Calculating cryptographic hashes (such as SHA-256) of acquired forensic images immediately after acquisition establishes a baseline for integrity verification. This mathematical proof ensures that the evidence has not been altered during subsequent analysis, which is critical for admissibility in legal proceedings.
- ✗
Disable all logging before acquisition
Why it's wrong here
Disabling system or application logging destroys crucial forensic artifacts and severely reduces visibility into the incident. This action violates the core principle of preserving the original state of the compromised system and prevents responders from reconstructing the timeline of malicious activities.
- ✓
Maintain chain-of-custody documentation
Why this is correct
Maintaining a meticulous chain-of-custody log is essential to document the chronological history of evidence handling, transfer, and storage. This documentation proves that the evidence remained secure and untampered with from the moment of collection to its presentation in court.
- ✗
Edit suspicious files to see whether malware reacts
Why it's wrong here
Modifying or interacting directly with suspicious files on a live, compromised system alters critical metadata (such as MACB timestamps) and risks triggering anti-analysis or destructive payloads. Forensic best practices dictate that analysis must be conducted on isolated copies, never on the original evidence.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.