First Response →mediumMultiple ChoiceObjective-mapped

212-89 First Response Practice Question

You are performing an investigation on a compromised mobile device. What is the primary risk of connecting the device to a standard workstation without a write blocker?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The workstation might write metadata or sync files, altering the original evidence.

Connecting a mobile device without a physical or software write blocker can lead to automatic synchronization or data modification by the host OS.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The battery will drain faster.
Why it's wrong here
This is not a forensic risk.
✓
The workstation might write metadata or sync files, altering the original evidence.
Why this is correct
Operating systems often mount devices and update last access times or index files.
✗
The workstation will be instantly infected.
Why it's wrong here
While possible, data integrity is the primary concern for evidence preservation.
✗
The device will automatically wipe itself.
Why it's wrong here
This is rare, but data modification is the primary concern.

About these practice questions

Courseiva writes every 212-89 question from scratch — 206 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official EC-Council exam blueprint

Ready to practise?

Turn this into a habit — start a practice session.

Start practice session

Timed practice sets

Quick scored rounds with instant marking and a written explanation per question.

212-89 Practice Questions 2 — 50 Questions→212-89 Practice Exam 1 — 20 Questions→

Domain-focused practice

Each domain maps to a weighted exam section. Focus on the domain where you are weakest.

First Response Email Incidents Malware Incidents

Practice by scenario

Filter questions by type — troubleshooting, exhibit, drag-and-drop, multi-select, and more.

Browse scenarios

Practice by topic

Each topic page collects the questions that test one concept, plus the theory behind it.

First Response practice questions Incident Handling Process practice questions 212-89 scenario practice questions Network Incidents practice questions 212-89 troubleshooting practice questions

Where to go next

All 212-89 questions All EC-Council practice questions Certified Incident Handler (212-89) exam guide

This 212-89 practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 212-89 exam.