SY0-701 Security Operations Practice Question
After seizing a suspected insider's laptop, a responder makes a bit-for-bit image of the drive. The legal team asks what step most directly proves the image was not altered after acquisition. What should be done?
⚠ Common exam trap
Candidates often confuse documentation steps (like recording hostnames) with integrity verification, or think that copying files to a USB drive is a valid forensic preservation method, when only cryptographic hashing provides mathematical proof of non-alteration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compute and document cryptographic hashes of the source media and the forensic image.
Computing and documenting cryptographic hashes (e.g., SHA-256 or MD5) of both the source media and the forensic image immediately after acquisition creates a verifiable digital fingerprint. If the hash values match, it proves that the image is an exact, unaltered copy of the original drive. This step is foundational to maintaining the chain of custody and ensuring data integrity in forensic investigations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Record the laptop's hostname and the user who last logged in.
Why it's wrong here
Recording the hostname and last logged-in user is part of standard incident-response documentation and helps contextualize the investigation, but it does not validate the forensic image's integrity. Only a cryptographic hash of the original media and the resulting image can prove that the evidence remained bit-for-bit unchanged during acquisition. Without that verification, the data cannot be trusted as admissible.
- ✓
Compute and document cryptographic hashes of the source media and the forensic image.
Why this is correct
Compute and document cryptographic hashes of both the source media and the forensic image using a collision-resistant algorithm like SHA-256. The hash generated from the source device and the hash of the acquired image must match exactly, providing strong evidence that no data was altered, added, or lost. This integrity check is a foundational practice in forensic imaging and is necessary to demonstrate the evidence is authentic and admissible in court.
- ✗
Copy the most recent files to a USB drive for quick review.
Why it's wrong here
Copying only the most recent files to a USB drive is not forensically sound because it alters file metadata and may skip critical artifacts such as deleted files, slack space, and unallocated clusters. It also fails to capture the full file system structure and system files needed for a thorough analysis. A proper forensic image must be a complete bit-for-bit copy taken through a write-blocker, not a selective copy, which omits the very data that often carries evidentiary value.
- ✗
Return the laptop to the user once the image is saved.
Why it's wrong here
Returning the laptop to the user after imaging risks contamination, tampering, or remote wiping, which would destroy evidence and break the chain of custody. Even if a forensic image already exists, the original medium must be preserved securely until the case concludes, and every transfer of custody must be documented. Releasing the device prematurely undermines the credibility of the entire investigation and could compromise legal proceedings.
Go deeper
Related to this question
Learn chapter
Digital Forensics Basics
Key term
Forensic image
A forensic image is an exact, bit-for-bit copy of a storage device, including all deleted and hidden data, created and preserved for digital investigation.
Key term
SHA-256
SHA-256 is a cryptographic hash function that takes any input data and produces a fixed 256-bit string of characters, like a unique digital fingerprint, used to verify data integrity and secure passwords.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.