The correct answer is to calculate and compare the image hash to the source hash before analysis. This step is essential because hashing algorithms like MD5, SHA-1, or SHA-256 produce a unique digital fingerprint of the data; if the hash of the forensic image matches the hash of the original source, it proves the image is an exact, unaltered copy. On the Security+ SY0-701 exam, this concept tests your understanding of forensic integrity and chain of custody—a common trap is to jump straight into analysis or try to recover deleted files first, but hash verification must always come first to ensure evidence admissibility. Remember the memory tip: “Hash first, analyze last”—verifying the hash is the foundational lock that keeps the evidence chain intact.
SY0-701 Security Operations Practice Question
This SY0-701 practice question tests your understanding of security operations. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Evidence Receipt Form
Case: 24-1187
Item: 4A
Description: SSD from workstation WS-14
Acquisition Method: Bit-for-bit image created with write blocker
Source SHA-256: 9e8f1a7c4c0d2f1b...
Image SHA-256: not yet calculated
Chain of Custody: pending analyst verification
Based on the exhibit, what should the analyst do before opening the forensic image for examination?
Evidence Receipt Form
Case: 24-1187
Item: 4A
Description: SSD from workstation WS-14
Acquisition Method: Bit-for-bit image created with write blocker
Source SHA-256: 9e8f1a7c4c0d2f1b...
Image SHA-256: not yet calculated
Chain of Custody: pending analyst verification
A
Mount the image read-write so the analyst can begin searching immediately.
Why wrong: Read-write access can alter evidence and may damage the image's forensic value.
B
Calculate and compare the image hash to the source hash before analysis.
Hash verification confirms that the forensic image matches the original drive and has not changed during transfer or storage. This is a key evidence-handling step because it supports integrity and admissibility. The analyst should document the result in the case notes and chain of custody before examining the contents.
C
Defragment the original SSD so the files will be easier to search later.
Why wrong: Defragmenting the original drive would alter evidence and is not a forensic-preservation step.
D
Compress the image into a ZIP file to reduce storage usage before verifying it.
Why wrong: Compression is not a substitute for integrity verification and may complicate evidence handling.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Calculate and compare the image hash to the source hash before analysis.
Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Mount the image read-write so the analyst can begin searching immediately.
Why it's wrong here
Read-write access can alter evidence and may damage the image's forensic value.
✓
Calculate and compare the image hash to the source hash before analysis.
Why this is correct
Hash verification confirms that the forensic image matches the original drive and has not changed during transfer or storage. This is a key evidence-handling step because it supports integrity and admissibility. The analyst should document the result in the case notes and chain of custody before examining the contents.
Related concept
Read the scenario before looking for a memorised answer.
✗
Defragment the original SSD so the files will be easier to search later.
Why it's wrong here
Defragmenting the original drive would alter evidence and is not a forensic-preservation step.
✗
Compress the image into a ZIP file to reduce storage usage before verifying it.
Why it's wrong here
Compression is not a substitute for integrity verification and may complicate evidence handling.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think mounting the image immediately is efficient, but they overlook the critical integrity check required before any analysis to ensure the evidence is unaltered.
Detailed technical explanation
How to think about this question
Hash verification uses cryptographic hash functions like SHA-256 (per NIST SP 800-86) to produce a fixed-size digest that uniquely represents the image data. Even a single bit change in the image results in a completely different hash (avalanche effect), making tampering detectable. In real-world forensics, tools like FTK Imager or dd with sha256sum are used to generate and compare hashes before any analysis begins.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A SOC analyst notices unusual lateral movement in the network at 2 AM. The IR playbook dictates: identify and contain (isolate the affected machine), then eradicate (remove the malware), then recover (restore from backup), then document. Skipping containment before eradication risks the attacker regaining access. Questions like this test the sequence and rationale of incident response phases.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Calculate and compare the image hash to the source hash before analysis. — Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.