A forensic examiner has collected a disk image and a memory dump from a suspect's computer. The examiner needs to present the evidence in court. Which combination of actions best ensures the evidence is admissible and its integrity is demonstrable?

Analyze the original disk image directly to avoid any copy errors.

Encrypt the evidence with a strong password and share the password with the court.

Make multiple copies of the evidence and distribute them to the defense and prosecution.

Document the chain of custody, compute and record hashes of both the image and memory dump, and store the originals in a secure evidence locker.

A forensic team is collecting evidence from a server that was involved in a data breach. The team has limited time and must decide between creating a full disk image or collecting only specific files. The legal team requires that the evidence be admissible in court. Which decision is most appropriate?

Use a network sniffer to capture traffic instead of imaging the disk.

Create a full disk image and compute a hash of the image.

Take a screenshot of the server's screen and document it.

Collect only the files that are directly related to the breach.

A forensic team is preserving evidence from a cloud-hosted virtual machine that is suspected of being compromised. The team needs to ensure the evidence is preserved and can be verified later. Which approach is the most appropriate?

Log into the VM and copy the relevant files to a cloud storage bucket.

Power off the VM immediately and copy the virtual disk file from the storage backend.

Rely on the cloud provider's built-in logging and monitoring data only.

Take a snapshot of the VM using the cloud provider's snapshot feature, then export the snapshot and compute a hash of the exported image.

An incident responder must preserve evidence from a compromised Linux server. The server is still running, and the responder wants to avoid altering the original data. Which approach is most appropriate?

Copy only the files related to the incident to a USB drive.

Reboot the server into a forensic boot environment before imaging.

Create a bit-for-bit image of the disk using a write-blocker.

Run the `dd` command directly on the live filesystem.

Which of the following represents the correct order for collecting digital evidence as described in NIST SP 800-86?

Memory, network connections, running processes, disk

Network connections, disk, memory, running processes

Running processes, disk, memory, network connections

Disk, memory, running processes, network connections

CiscoCertified CyberOps Associate

Domain 5Objective 6

5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 3)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

15%of the exam

Questions 11–15

11expert · hard
A forensic examiner has collected a disk image and a memory dump from a suspect's computer. The examiner needs to present the evidence in court. Which combination of actions best ensures the evidence is admissible and its integrity is demonstrable?
Select an answer first
12expert · hard
A forensic team is collecting evidence from a server that was involved in a data breach. The team has limited time and must decide between creating a full disk image or collecting only specific files. The legal team requires that the evidence be admissible in court. Which decision is most appropriate?
Select an answer first
13expert · hard
A forensic team is preserving evidence from a cloud-hosted virtual machine that is suspected of being compromised. The team needs to ensure the evidence is preserved and can be verified later. Which approach is the most appropriate?
Select an answer first
14application · medium
An incident responder must preserve evidence from a compromised Linux server. The server is still running, and the responder wants to avoid altering the original data. Which approach is most appropriate?
Select an answer first
15foundation · easy
Which of the following represents the correct order for collecting digital evidence as described in NIST SP 800-86?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.