SSCP Incident Response and Recovery Practice Question
An incident responder needs to create a forensic image of a suspect hard drive. Which of the following steps is ESSENTIAL to ensure the integrity of the evidence?
⚠ Common exam trap
A common trap in SSCP is the misconception that booting the system or running software-based checks is acceptable. However, any interaction with the original drive that could alter its state—even a read-only mount without a write blocker—can change metadata and break the chain of custody.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a write blocker to prevent modification of the original drive
Using a write blocker is essential because it ensures that no data can be written to the suspect hard drive during the imaging process, preserving the original evidence in a forensically sound state. Without a write blocker, any operating system or imaging tool could inadvertently modify metadata (e.g., access timestamps) or the file system, which would compromise the integrity and admissibility of the evidence in legal proceedings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Run an antivirus scan on the drive before imaging
Why it's wrong here
Running scans modifies the drive; imaging should be done first.
- ✓
Use a write blocker to prevent modification of the original drive
Why this is correct
A write blocker ensures read-only access, preserving the integrity of the original evidence.
- ✗
Boot the suspect system to verify it is functional
Why it's wrong here
Booting the system alters evidence (e.g., writes logs, changes timestamps). This should be avoided.
- ✗
Perform the imaging over the network to save time
Why it's wrong here
Network imaging may introduce errors and is not recommended for forensics; a direct connection is preferred.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.