SY0-701 Security Operations Practice Question
You are handed a company laptop suspected in an insider theft case. Legal says the evidence may be needed in court. Which action best preserves admissibility?
⚠ Common exam trap
Watch out — candidates often think direct browsing or read-write mounting is faster and acceptable, but they fail to recognize that any write access—even unintentional—breaks forensic integrity and admissibility in legal proceedings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a forensic image using a write blocker and record hash values.
Creating a forensic image with a write blocker ensures the original evidence remains unaltered, preserving its integrity for court admissibility. Recording hash values (e.g., SHA-256) provides a cryptographic fingerprint that can later verify the image is an exact copy, meeting legal standards for chain of custody and authenticity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Browse the drive directly on the original laptop to identify the most relevant files.
Why it's wrong here
Browsing the drive while still using the original laptop means the examination is happening against a live, running operating system whose own background processes are constantly writing to the disk. Every opened folder or file can update access-time attributes, trigger Windows Search indexing, and append information to the NTFS $LogFile and USN Journal, making it impossible to tell what was pre-existing versus examiner-induced. This destroys the unaltered state of the evidence and is why the original drive must be removed and imaged through a write blocker before any analysis.
- ✓
Create a forensic image using a write blocker and record hash values.
Why this is correct
A forensic image taken through a write blocker is the best choice because it preserves the original media and reduces the chance of accidental modification. Recording cryptographic hash values before and after acquisition helps prove integrity and supports chain of custody. That combination is standard practice when evidence might be examined in a disciplinary, regulatory, or legal setting.
- ✗
Email the user asking them to return any copies they may have made.
Why it's wrong here
Sending an email to the user is a spoliation risk, not an evidence-preservation step: it alerts the suspect to the investigation and gives them time to delete files, run wipe tools, or trigger remote-wipe/encryption features before the device can be secured and imaged. It also fails to create a bit-for-bit forensic copy, record SHA-256 hashes, or document an unbroken chain of custody, so any later evidence recovered from the company's own files could be attacked as incomplete or tainted. While recovering copies might serve HR or asset-recovery goals, it cannot substitute for a defensible forensic acquisition.
- ✗
Mount the drive read-write so searching and exporting data will be faster.
Why it's wrong here
Mounting the drive read-write, even temporarily, causes the OS to issue write commands to the filesystem — updating timestamps, altering directory entries, journaling transactions in the $LogFile, and possibly modifying file content via on-access scanners or search indexers. Once those writes occur, the original media no longer matches the state at seizure, so a hash comparison between source and image would fail to prove integrity. The only acceptable method is to use a hardware write blocker to make the drive read-only at the interface level, then create a forensic image; export speed is irrelevant when the original evidence must remain pristine.
Go deeper
Related to this question
Learn chapter
Chain of Custody in Digital Forensics
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
SHA-256
SHA-256 is a cryptographic hash function that takes any input data and produces a fixed 256-bit string of characters, like a unique digital fingerprint, used to verify data integrity and secure passwords.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.