Free Incident Response, Licensing, and Regulated Data practice questions
10 free 220-1202 questions on Incident Response, Licensing, and Regulated Data, each with a full explanation — no account needed. This section sits in the Operational Procedures part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A technician is decommissioning several old hard drives from a healthcare facility that stored patient information. The organization requires proof of secure disposal for auditing. Which approach BEST meets this requirement?
When patient data is involved and an organization needs proof of secure disposal for audits, using a certified disposal vendor that provides documentation of destruction is the best choice. Certified vendors supply proof and support chain-of-custody records, which document who handled the device, when transfers occurred, and where it ended up. This satisfies both the secure disposal requirement and the record-keeping needed during audits. Performing a quick format does not securely erase data, since a format only removes file system references and leaves the underlying data recoverable, making it inadequate for sensitive health information. Deleting visible files and emptying the recycle bin is even weaker, as the actual data remains on the drive and can be recovered with basic tools, so this fails to protect protected health information. Storing the drives in a locked cabinet indefinitely does not dispose of the data at all; it merely delays the risk and creates a growing liability, since old devices are quiet risks that can store data long after users forget. Proper end-of-life handling options include secure erase, crypto erase when full-disk encryption is used, degaussing for magnetic media, and physical destruction such as shredding. When audits and retention rules apply, documented, verifiable destruction is what protects both the organization and the technician.
While repairing a user's laptop, a technician opens a folder and sees what appears to be illegal images. Which of the following should the technician do FIRST?
When a technician discovers prohibited content, the correct first action is to stop immediately and report it through the proper channels, such as a supervisor, security team, or incident-response contact. As a first responder, the technician's job is to recognize that something is wrong and hand it off correctly, not to investigate. Copying the files to a USB drive alters the system state, changes timestamps, and can spread or duplicate illegal material, exposing the technician to legal risk. Deleting the files destroys evidence and may itself be a crime, since preservation of the original state is essential to any later investigation. Confronting the user tips off the suspected party, giving them the opportunity to destroy evidence and compromising the investigation. The disciplined incident-response flow is to identify, report through proper channels, preserve both the data and the device, and document everything. Restraint is a feature of good incident response, not a shortcoming, because improvising can destroy a case and leave the technician personally liable.
A technician needs to make a forensic copy of a suspect's hard drive while guaranteeing that not a single bit on the original is modified during the process. Which of the following tools should be used?
A write blocker is a hardware or software device that permits reading from a drive but physically prevents any write operation, ensuring the mere act of imaging does not alter a single bit of the source. This preserves the original evidence in its found state while a bit-for-bit forensic image is created for analysis. A disk defragmenter reorganizes data on a drive by actively writing to it, which would alter the evidence and destroy its integrity. A cloning cable simply transfers data between drives but offers no guarantee against writing to the source and does not prevent modification of the original. Boot media is used to start a system from an external device and does not protect against writes to the evidence drive; booting from the suspect drive could itself change its state. In digital forensics, you never work on the original evidence, and the write blocker is the technical safeguard that makes trustworthy imaging possible while the original is sealed and stored securely.
During evidence collection on a running computer, a technician must gather data in the correct sequence to avoid destroying it. Which of the following should be collected FIRST according to the order of volatility?
The order of volatility dictates that the most fragile, short-lived data is collected first before it disappears. Of the options listed, the contents of RAM and the process table are the most volatile because live memory and the running state of the system are lost the moment the machine powers off. Data stored on the hard drive is nonvolatile persistent storage that survives a reboot, so it can be collected later. Archival backups and physical media are among the most stable, longest-lived evidence and are collected near the end of the sequence. Remote logging and monitoring data is stored off the machine and is relatively persistent, making it lower priority than volatile memory. If a technician powers a machine off before capturing RAM, everything in memory such as running malware, encryption keys, and active network connections is gone forever. This is why incident-response policy often calls for capturing volatile memory before doing anything else, and why a machine that may hold evidence should never be rebooted without direction from the investigation team.
A manager quietly asks a help-desk technician to 'pull some files' from a departing employee's laptop that may contain evidence of data theft. Which of the following is the MOST appropriate response?
When a device may become evidence, the professional response is to preserve it, avoid altering its state, log that it was received, secure it, and escalate through the proper incident-response channels with a signed record. The technician is often the first person to touch a device that later becomes evidence, and those first minutes decide whether the evidence survives. Copying the requested files and emailing them alters timestamps, breaks the chain of custody, and may leak sensitive data through an improper path. Browsing the laptop to confirm the theft changes the system state, destroys evidentiary integrity, and oversteps the technician's role, since first responders do not investigate. Rebooting the laptop and running an antivirus scan writes to the disk, destroys volatile memory, and can overwrite recoverable data, rendering evidence inadmissible. The right answer always favors preservation, proper sequence, and documentation over convenience, letting the investigation team handle analysis with a defensible custody trail.
A technician creates a forensic image of a drive and wants to prove the copy is an exact duplicate of the original and that neither is altered afterward. Which of the following techniques accomplishes this?
Forensic tools compute a cryptographic hash such as SHA-256 of both the source drive and the image; if the two hash values match, the copy is verified as an exact bit-for-bit duplicate. That hash is recorded in the documentation, and re-hashing later and comparing it to the recorded value proves the data has not been altered, because any tampering would produce a different hash. This is the technical mechanism that backs up the chain of custody. Verifying that both drives report identical capacities only confirms drive size and says nothing about whether the actual data content matches. Checking that file counts match only compares visible allocated files and ignores deleted files, slack space, and metadata that a forensic image captures. Confirming the copy operation completed without errors indicates the process finished but provides no cryptographic proof that every sector is identical or that the data remains unaltered over time. Only a matching cryptographic hash provides the mathematical guarantee of integrity required for evidence.
A technician discovers an active ransomware infection that appears to be exfiltrating data across the network. According to incident-response best practices, how should the technician stop the ongoing damage while preserving evidence?
To stop ongoing damage or data exfiltration while preserving evidence, the correct action is to isolate the system from the network by unplugging the network cable or disabling the wireless adapter rather than shutting it down. This halts the exfiltration without destroying volatile evidence that lives in RAM, such as running malware, encryption keys, and active connections. Shutting down the computer immediately destroys all volatile memory contents forever, permanently eliminating evidence that may be critical to the investigation. Running a full malware removal tool writes to the disk, overwrites potentially recoverable data, and alters the system state, which compromises evidentiary integrity. Restoring the system from a backup image wipes out the evidence entirely and treats the incident as a routine repair rather than a matter requiring preservation. Isolation stops the harm while keeping the machine in a state that allows later forensic imaging and memory analysis, and any change made, such as unplugging a cable, must be documented with exactly what was changed, when, and why.
A hard drive collected as evidence was left unattended on a desk overnight with no record of who had access to it. Which of the following has occurred?
The chain of custody is the chronological, documented record of everyone who handled a piece of evidence, and it requires that evidence be accounted for continuously with no gaps. When a drive sits unattended overnight with no record of access, there is an unexplained gap, so the chain is broken and opposing counsel can argue the evidence was tampered with, potentially causing a court to throw it out. The order of volatility concerns the sequence in which volatile versus nonvolatile data is collected during acquisition, which is unrelated to how the drive was stored afterward. A failed hash verification would indicate the forensic image does not match the original, but nothing here shows hashing was performed or failed. A missing write blocker relates to preventing writes during imaging, not to physical storage of evidence. Evidence must be stored in secure, access-controlled locations such as a locked evidence locker or safe, and every handoff must be signed by both the releasing and receiving parties to keep the chain intact.
A technician is writing up documentation immediately after discovering a policy violation on a workstation. Which of the following BEST describes how the documentation should be recorded?
Incident documentation should record the facts objectively, without speculation or blame, and be captured contemporaneously, meaning as events happen rather than from memory hours later. Good documentation is the technician's protection and the investigation's backbone, and it should stick to what was actually observed, including who, what, when, where, and how. Summarizing from memory at the end of the workday introduces errors and gaps, undermining the reliability of the record and weakening any later legal or HR proceeding. Recording the technician's conclusions about who is at fault injects speculation and blame, which is exactly what objective documentation must avoid; the first responder recognizes a problem but does not determine guilt. Sharing details in the team group chat is itself a policy violation that can compromise an investigation, defame an innocent person, or leak sensitive details. Documentation may become part of the chain of custody or serve as evidence, so it must be factual, timely, and handled through proper channels, not broadcast to coworkers.
A technician suspects a workstation contains child sexual abuse material discovered during a repair. Regarding law enforcement involvement, which of the following is the correct action for the technician?
For certain categories of prohibited content, most notably suspected child exploitation material, there are legal obligations to involve law enforcement, but the organization's policy dictates exactly who makes that contact. The technician should report the matter internally through proper channels and let management and legal engage law enforcement. A technician should never take it upon themselves to contact outside agencies directly. Contacting local law enforcement directly bypasses organizational policy and the chain of command, and handing over the device outside proper procedure can break the chain of custody. Posting the discovery to an online portal anonymously is not the established reporting path, fails to preserve evidence properly, and does not follow the organization's incident-response policy. Notifying the device owner tips off the suspected party, giving them the opportunity to destroy evidence, and is never appropriate when an individual is the subject of an incident. The correct discipline is to identify, report internally through proper channels, preserve the data and device untouched, and document everything, allowing the appropriate authorities to be engaged by the right people in the right order.
Study this section
Every lesson that covers Incident Response, Licensing, and Regulated Data on the 220-1202 exam.