SY0-701 Security Operations Practice Question
After seizing a suspect's laptop, a responder creates a bit-for-bit disk image using a write blocker. The legal team wants the next step that most directly supports evidence integrity for later review. What should the responder do?
⚠ Common exam trap
Many exam-takers think browsing the image is harmless or that antivirus scans are always safe, but the exam tests the strict forensic requirement to never modify original evidence and to use hashing as the sole direct integrity check.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compute and document cryptographic hash values for the source and the image.
Computing and documenting cryptographic hash values (e.g., SHA-256 or MD5) for both the source drive and the bit-for-bit image creates a digital fingerprint. If the hashes match, it proves the image is an exact, unaltered copy of the original evidence, directly supporting integrity for later review. This step is foundational in forensic acquisition to meet legal standards for admissibility.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Open the image file and browse folders to confirm the contents look normal.
Why it's wrong here
Browsing the image with forensic tools is part of analysis, not verification. Viewing folder contents confirms nothing about the raw bitstream—a file can look present yet the image could still be a non-identical copy due to bad sectors or a faulty imaging process. Browsing also does not generate a cryptographic digest, so there is no record that can be compared later to prove the image remains unchanged since seizure.
- ✓
Compute and document cryptographic hash values for the source and the image.
Why this is correct
The responder should hash the original source device (ideally via a write-blocked interface) and then hash the freshly created image file using a strong algorithm such as SHA-256. If the two digests match, the evidence is mathematically proven to be a bit-for-bit copy, and any future alteration can be detected by re-hashing the image and comparing to the documented value. Recording the algorithm, hash, and timestamp in the chain-of-custody gives investigators and courts an independent, verifiable method to confirm the image's integrity at any later point.
- ✗
Rename the image file with the case number and store it on a desktop.
Why it's wrong here
Renaming the image with a case number only adds a label; it has no cryptographic relation to the file's contents and cannot reveal changes to the data. Placing the image on an analyst's desktop, rather than dedicated write-protected forensic storage, exposes it to accidental deletion, modification, or unauthorized access—all of which break the chain of custody. Proper evidence management dictates storing the image on a validated storage device with its hash and a documented audit trail, not just a convenient folder on a workstation.
- ✗
Run a full antivirus scan on the image before logging it in.
Why it's wrong here
An antivirus scan examines logical file structures and can alter access timestamps or quarantine contents if the image is mounted, which itself changes the evidence. More importantly, malware detection is not an integrity mechanism—it does not compare the image to the source or produce a cryptographic digest, so it cannot prove the image is unaltered. Any such scan should be performed after the hash is verified, and on a separate working copy, never on the pristine forensic image.
Go deeper
Related to this question
Learn chapter
Digital Forensics Basics
Key term
SHA-256
SHA-256 is a cryptographic hash function that takes any input data and produces a fixed 256-bit string of characters, like a unique digital fingerprint, used to verify data integrity and secure passwords.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.