CND Practice Question: Incident Detection Response And Threat Prediction
During a post-incident forensic investigation, an analyst needs to establish cryptographic proof that an acquired disk image has not been altered or tampered with since collection. Which tool and command parameter combination is standard for generating a cryptographically secure hash of the evidence file?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
sha256sum evidence.raw
To verify evidence integrity, cryptographic hashing algorithms such as SHA-256 or MD5 are used. On Linux systems, the 'sha256sum' utility is standard for generating hashes to verify file integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
dd if=/dev/sdb of=/evidence.raw --hash=md5
Why it's wrong here
The standard Linux dd utility does not natively support a --hash parameter during raw imaging operations.
- ✗
ftk_imager --verify --md5 evidence.raw
Why it's wrong here
FTK Imager CLI uses specific syntax (such as ftk imager --cli) and does not take '--verify' in this format.
- ✗
volatility -f evidence.raw --hash
Why it's wrong here
Volatility is a memory forensics framework and does not generate cryptographic file integrity hashes.
- ✓
sha256sum evidence.raw
Why this is correct
The sha256sum utility correctly computes a 256-bit cryptographic checksum of the specified evidence file to ensure integrity.
About these practice questions
One of 323 original CND practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official EC-Council exam blueprint
This CND practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CND exam.