During an incident response, an analyst must collect evidence from a running Windows workstation. The analyst has limited time before the system must be shut down. Which piece of data should the analyst collect first?

Contents of the Windows registry

List of active network connections

A forensic examiner is collecting evidence from a mobile phone. The examiner wants to ensure that the evidence is not modified during the collection process. Which step is most important?

Remove the SIM card and battery immediately.

Place the phone in airplane mode or a Faraday bag to prevent network communication.

Connect the phone to a computer and use standard file explorer to copy files.

Turn on the phone and browse through the apps to find relevant data.

A forensic examiner is investigating a case where the original hard drive is failing and may become unreadable at any moment. The examiner has already collected volatile data. Which action is the best way to preserve the evidence?

Create a bit-for-bit image of the drive immediately, using a hardware write-blocker, and then hash the image.

Copy the most important files to an external drive first.

Power off the drive and wait for a specialist to handle it later.

Run a disk repair tool to fix any errors on the drive before imaging.

A forensic analyst is collecting evidence from a laptop that was used in a data breach. The analyst wants to ensure that the evidence is admissible in court. Which action is most important for maintaining the chain of custody?

Make multiple copies of the evidence and distribute them.

Document every person who handled the evidence and when.

Use the fastest available storage device for the image.

Encrypt the evidence with a strong algorithm.

CiscoCertified CyberOps Associate

Domain 5Objective 6

5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 6)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

15%of the exam

Questions 26–30

26foundation · easy
Which of the following is an example of volatile data that should be collected before powering off a system?
Select an answer first
27application · medium
During an incident response, an analyst must collect evidence from a running Windows workstation. The analyst has limited time before the system must be shut down. Which piece of data should the analyst collect first?
Select an answer first
28application · medium
A forensic examiner is collecting evidence from a mobile phone. The examiner wants to ensure that the evidence is not modified during the collection process. Which step is most important?
Select an answer first
29expert · hard
A forensic examiner is investigating a case where the original hard drive is failing and may become unreadable at any moment. The examiner has already collected volatile data. Which action is the best way to preserve the evidence?
Select an answer first
30application · medium
A forensic analyst is collecting evidence from a laptop that was used in a data breach. The analyst wants to ensure that the evidence is admissible in court. Which action is most important for maintaining the chain of custody?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.