SY0-701 Security Operations Practice Question
Exhibit
Evidence Receipt Form Case: 24-1187 Item: 4A Description: SSD from workstation WS-14 Acquisition Method: Bit-for-bit image created with write blocker Source SHA-256: 9e8f1a7c4c0d2f1b... Image SHA-256: not yet calculated Chain of Custody: pending analyst verification
Based on the exhibit, what should the analyst do before opening the forensic image for examination?
⚠ Common exam trap
It's easy for candidates to think mounting the image immediately is efficient, but they overlook the critical integrity check required before any analysis to ensure the evidence is unaltered.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Calculate and compare the image hash to the source hash before analysis.
Before examining a forensic image, the analyst must verify its integrity by calculating its hash (e.g., MD5, SHA-1, SHA-256) and comparing it to the known hash of the original source. This ensures the image is an exact, unaltered copy, which is critical for maintaining the chain of custody and admissibility of evidence. Option B is correct because hash verification is the foundational step in forensic analysis.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mount the image read-write so the analyst can begin searching immediately.
Why it's wrong here
Mounting an image read-write allows the operating system to write to the volume, which can modify file timestamps, update access times, alter journal logs, and create temporary files, thereby changing the forensic artifact. This violates the fundamental forensic principle of preserving evidence in its original state. Always mount read-only or use a hardware write-blocker, and complete hash verification before any examination.
- ✓
Calculate and compare the image hash to the source hash before analysis.
Why this is correct
Hash verification confirms that the forensic image matches the original drive and has not changed during transfer or storage. This is a key evidence-handling step because it supports integrity and admissibility. The analyst should document the result in the case notes and chain of custody before examining the contents.
- ✗
Defragment the original SSD so the files will be easier to search later.
Why it's wrong here
Defragmentation is a write-intensive process that reorganizes file blocks, which permanently changes the data layout on the original SSD and can overwrite unallocated space, destroying potential deleted-file evidence. Modern SSDs also perform background garbage collection and TRIM, so additional writes to the original drive are especially harmful. Defragmenting is never a forensic preservation technique and must be avoided.
- ✗
Compress the image into a ZIP file to reduce storage usage before verifying it.
Why it's wrong here
Compressing a forensic image into a ZIP file does not verify its integrity and introduces an extra layer that could confuse the hash verification process (e.g., if the hash is computed on the archive rather than the raw image). The correct procedure is to compute a cryptographic hash (e.g., SHA-256) of the original image and compare it to the source value before any compression or conversion. If compression is truly needed, it should be done only after verification, using a format that preserves the original bits, and the archive's own integrity should be separately checked.
Go deeper
Related to this question
Learn chapter
Chain of Custody in Digital Forensics
Key term
SHA-256
SHA-256 is a cryptographic hash function that takes any input data and produces a fixed 256-bit string of characters, like a unique digital fingerprint, used to verify data integrity and secure passwords.
Key term
Forensic image
A forensic image is an exact, bit-for-bit copy of a storage device, including all deleted and hidden data, created and preserved for digital investigation.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.