An incident responder is called to a site where a server is suspected of being compromised. The server is currently running, but the responder knows that the system may need to be powered off soon. Which of the following should be collected before powering off the system?

Running processes and memory contents

Event logs from the operating system

A forensic examiner needs to collect evidence from a server that is part of an ongoing investigation. The examiner wants to ensure that the evidence remains unchanged and can be verified later in court. Which practice best supports data integrity?

Copy the evidence using a standard file copy command.

Store the evidence on the same server from which it was collected.

Disable logging on the server during collection.

Compute a cryptographic hash of the evidence before and after collection.

Why is it important to use a write blocker when preserving digital evidence from a hard drive?

To prevent any data from being written to the original drive

To encrypt the data on the original drive

To create a compressed image of the drive

To speed up the data acquisition process

CiscoCertified CyberOps Associate

Domain 5Objective 6

5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 7)

Part of the 5.0 Security Policies and Procedures domain, which accounts for 15% of the 200-201 exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

4concepts

15%of the exam

Questions 31–34

31application · medium
An incident responder is called to a site where a server is suspected of being compromised. The server is currently running, but the responder knows that the system may need to be powered off soon. Which of the following should be collected before powering off the system?
Select an answer first
32foundation · easy
Which technique is used to preserve digital evidence by creating an exact bit-for-bit copy of a storage device?
Select an answer first
33application · medium
A forensic examiner needs to collect evidence from a server that is part of an ongoing investigation. The examiner wants to ensure that the evidence remains unchanged and can be verified later in court. Which practice best supports data integrity?
Select an answer first
34foundation · easy
Why is it important to use a write blocker when preserving digital evidence from a hard drive?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to 200-201

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “200-201” is a trademark of its owner, used for identification only.

5.6 Describe Concepts as Documented in NIST.SP800-86 200-201 Practice Questions (Page 7)

Questions 31–34

An incident responder is called to a site where a server is suspected of being compromised. The server is currently running, but the responder knows that the system may need to be powered off soon. Which of the following should be collected before powering off the system?

Which technique is used to preserve digital evidence by creating an exact bit-for-bit copy of a storage device?

A forensic examiner needs to collect evidence from a server that is part of an ongoing investigation. The examiner wants to ensure that the evidence remains unchanged and can be verified later in court. Which practice best supports data integrity?

Why is it important to use a write blocker when preserving digital evidence from a hard drive?

Keep studying — 5.0 Security Policies and Procedures