A forensic analyst is about to image a hard drive from a computer that was used in a fraud case. The analyst wants to ensure that the imaging process does not modify the original drive. Which tool or technique should be used?

Booting the suspect's operating system and using a copy command

A standard USB-to-SATA adapter without any write protection

Using a network transfer to copy the drive contents to a server

A hardware write-blocker connected between the drive and the imaging workstation

What is the primary purpose of maintaining a chain of custody for digital evidence?

To encrypt the evidence so only authorized personnel can view it

To document every person who handled the evidence and when

To compress the evidence to save storage space

To ensure the evidence is backed up to a remote server

An incident responder is investigating a possible data breach on a laptop. The laptop is currently on, and the responder needs to collect evidence. Which of the following is an example of volatile data that should be collected immediately?

The contents of the laptop's RAM

The files in the user's Downloads folder

The operating system's registry hives

Which method is commonly used to verify that digital evidence has not been altered after collection?

Computing a cryptographic hash of the evidence

Compressing the evidence into a ZIP file

Encrypting the evidence with a public key

Copying the evidence to multiple drives

A security analyst is investigating a suspected data exfiltration on a user's laptop. The laptop is currently running, and the analyst has remote access. Which of the following is the most important volatile data to collect before the laptop is disconnected from the network?

The system's installed programs list.

The contents of the Recycle Bin.

Active network connections and listening ports.

CiscoCertified CyberOps Associate

Domain 5Objective 6

5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 1)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

15%of the exam

Questions 1–5

1application · medium
A forensic analyst is about to image a hard drive from a computer that was used in a fraud case. The analyst wants to ensure that the imaging process does not modify the original drive. Which tool or technique should be used?
Select an answer first
2foundation · easy
What is the primary purpose of maintaining a chain of custody for digital evidence?
Select an answer first
3application · medium
An incident responder is investigating a possible data breach on a laptop. The laptop is currently on, and the responder needs to collect evidence. Which of the following is an example of volatile data that should be collected immediately?
Select an answer first
4foundation · easy
Which method is commonly used to verify that digital evidence has not been altered after collection?
Select an answer first
5application · medium
A security analyst is investigating a suspected data exfiltration on a user's laptop. The laptop is currently running, and the analyst has remote access. Which of the following is the most important volatile data to collect before the laptop is disconnected from the network?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.