Understanding Cisco Cybersecurity Operations Fundamentals (CBROPS) — Question 35

What is a difference between tampered and untampered disk images?

Answer options

• A. Tampered images have the same stored and computed hash.
• B. Untampered images are deliberately altered to preserve as evidence.
• C. Tampered images are used as evidence.
• D. Untampered images are used for forensic investigations.

Correct answer: D

Explanation

Untampered images are those that remain in their original state and are critical for forensic investigations, ensuring the integrity of the evidence. In contrast, tampered images imply alterations, which compromise their reliability as evidence. Thus, option D is correct while the others misrepresent the characteristics of tampered and untampered images.