ISC2 CC Security Operations Practice Question
During an incident, an analyst collects a forensic image of a compromised server's disk. The organization's policy requires preserving evidence for potential legal proceedings. Which action best maintains the integrity of the collected evidence?
⚠ Common exam trap
The trap here is assuming that encryption or access restrictions equal integrity, when only a hash comparison can demonstrate the evidence has not changed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Compute and document a cryptographic hash of the image immediately after acquisition.
Cryptographic hashing at the time of acquisition establishes a verifiable baseline for the forensic image. Any later modification changes the hash, so a match confirms integrity. This practice, combined with documented chain of custody, supports the reliability of evidence in legal contexts. Working from a verified copy rather than the original also protects the source media, and preserving the full image without deletions ensures nothing is lost.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Analyze the original disk in place to avoid copying errors.
Why it's wrong here
Analyzing the original media risks modifying timestamps, log entries, or file contents simply through normal system activity. Forensic best practice is to work from a verified copy and leave the original untouched. Even read operations can change access times on some file systems, and any accidental write would compromise the evidence. In-place analysis weakens the ability to prove the evidence was not altered.
- ✗
Delete non-relevant files from the image to reduce size before storage.
Why it's wrong here
Removing any data from a forensic image destroys its completeness and makes it impossible to demonstrate the copy matches the original. Files that appear irrelevant may contain metadata, deleted fragments, or artifacts that later prove important. Evidence must be preserved in full. Altering the image in any way undermines its value in legal proceedings and breaks the chain of custody.
- ✗
Compress the image with a password to prevent tampering.
Why it's wrong here
Password-protecting an archive limits casual access but does not prove integrity. Anyone with the password could alter the contents and re-encrypt, and the protection itself provides no verifiable record of the original state. Integrity is established through hashing and documented custody, not through access controls on the container. Encryption may be useful for confidentiality but is not a substitute for integrity verification.
- ✓
Compute and document a cryptographic hash of the image immediately after acquisition.
Why this is correct
Hashing the forensic image at acquisition creates a verifiable fingerprint. If the hash is recomputed later and matches, it demonstrates the image has not been altered. This supports admissibility and chain-of-custody requirements because any change would produce a different value. Documenting the hash alongside acquisition details lets independent examiners confirm the copy is a faithful representation of the original media.
Go deeper
Related to this question
Learn chapter
Incident Response and Management
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
Key term
Forensic image
A forensic image is an exact, bit-for-bit copy of a storage device, including all deleted and hidden data, created and preserved for digital investigation.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.