Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.

Exam 200-201 topic 1 question 103 discussion

Actual exam question from Cisco's 200-201
Question #: 103
Topic #: 1
[All 200-201 Questions]

What is a difference between tampered and untampered disk images?

  • A. Tampered images have the same stored and computed hash.
  • B. Untampered images are deliberately altered to preserve as evidence.
  • C. Tampered images are used as evidence.
  • D. Untampered images are used for forensic investigations.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
beowolf
Highly Voted 8 months, 3 weeks ago
D is the correct answer.
upvoted 19 times
...
anonymous1966
Highly Voted 4 months, 3 weeks ago
"D" is correct. The disk image must be intact for forensics analysis. As a cybersecurity professional, you may be given the task of capturing an image of a disk in a forensic manner. Imagine a security incident has occurred on a system and you are required to perform some forensic investigation to determine who and what caused the attack. Additionally, you want to ensure the data that was captured is not tampered with or modified during the creation of a disk image process. Ref: Cisco Certified CyberOps Associate 200-201 Certification Guide By Glen D. Singh
upvoted 7 times
...
DaveEly
Most Recent 1 week, 2 days ago
Selected Answer: D
D. Untampered images are used for forensic investigations.
upvoted 1 times
...
ivlis_27
2 months ago
your answer is constracting to the question (two differences between untampered and tampered). I think the right answer should be D, why would you use tampered images as evidence? it has been tampered.
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
Loading ...