Exam 200-201 topic 1 question 103 discussion

D is the correct answer.

"D" is correct. The disk image must be intact for forensics analysis. As a cybersecurity professional, you may be given the task of capturing an image of a disk in a forensic manner. Imagine a security incident has occurred on a system and you are required to perform some forensic investigation to determine who and what caused the attack. Additionally, you want to ensure the data that was captured is not tampered with or modified during the creation of a disk image process. Ref: Cisco Certified CyberOps Associate 200-201 Certification Guide By Glen D. Singh

The right question is a D: untampered images used for the investigation process but I don't understand why you don't put the right question or justify your reason because when I looked up all the resources related all agree for D choice

The answer is D. Untampered images are used for forensic investigations. Tampered images are not used for forensic investigations because they cannot be trusted as evidence. Tampered images may have been modified or altered in a way that changes their content or meaning. This can make it difficult or impossible to use them to reconstruct the events that led to the creation of the image.

The answer is D. Untampered images are used for forensic investigations.

D is the correct answer.

The correct answer is D. Untampered images are used for forensic investigations. When referring to disk images in the context of digital forensics, a tampered image refers to an image that has been modified or altered in some way, potentially compromising its integrity and reliability as evidence. On the other hand, an untampered image is one that has not been altered and is considered a faithful representation of the original source.

Tampered evidence will of course be challenged in court and thrown out... Did they mean it?

who the hell clicked on C

D is the correct answer tampered with or modified during the creation of a disk image process. Ref: Cisco Certified

D should be the answer

D is correct

Respuesta B. Yo tengo una imagen de disco, y un atacante me manipula la imagen. La evidencia de que he sufrido un ataque es la imagen manipulada por el atacante, o sea mi imagen manipulada.

D is the correct answer.

D without any doubt

D is the correct answer.

D. Untampered images are used for forensic investigations.