SY0-701 Security Operations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Defragment the original SSD to make later analysis faster.

  Why it's wrong here

  Defragmenting the original SSD after imaging is a destructive procedure because it changes the physical placement of data and updates filesystem metadata, effectively altering the source evidence. For solid-state drives, defragmentation is especially counterproductive because the internal controller's wear-leveling algorithms already manage block placement, so the process provides no speed benefit while simultaneously modifying the very media an investigator must preserve. Any later legal challenge can argue that the original was contaminated, and even if the image exists, the inability to reacquire from an unchanged source can undermine the case.

• ✓

  Calculate cryptographic hashes of the source and the image and record them.

  Why this is correct

  Calculating and recording cryptographic hashes of both the source and the acquired image is the cornerstone of forensic integrity. A strong algorithm such as SHA-256 generates a fixed-length fingerprint, and when the hash values match, it proves the image is a bit-for-bit replica with no data altered or lost during acquisition. Recording those hashes in the investigator's notes or a signed report also establishes a verifiable chain of custody, allowing any independent examiner to re-run the same hash and confirm the evidence has not been modified. Without this step, there is no objective way to demonstrate that the image accurately represents the original source.

• ✗

  Compress the image file to reduce storage usage before documentation.

  Why it's wrong here

  Compressing the image file before documentation is an unsafe practice because compression algorithms, even lossless ones, alter the container format and can introduce file-system-level artifacts that confound forensic analysis. More importantly, compression does not establish or preserve integrity; a compressed copy can still be corrupted, and the decompressed data may differ from the source if errors occur during the process. Forensic integrity verification requires hashes computed directly on the uncompressed raw image, and documentation of those hashes must occur before any size-reduction step. If storage space is a concern, writing the image to a larger destination or using a validated forensic file format like E01 with embedded checksums is the proper approach—not arbitrary compression.

• ✗

  Wipe free space on the original SSD to remove deleted remnants.

  Why it's wrong here

  Wiping free space on the original SSD is a proactive alteration of the evidence source that destroys the very remnants a forensic exam might need. Free space can contain deleted files, fragments of prior data, or other artifacts that are recoverable, and wiping eliminates that historical data entirely. Even if the investigator already created an image, altering the original after acquisition invalidates the ability to later reacquire or verify the original as unmodified, which is a core requirement for evidence admissibility. The only acceptable action after imaging is to securely store the original without any modifications, preserving its state for potential defense or independent inspection.

Go deeper

Related to this question