ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 474 - SY0-601 discussion

Report
Export

Which of the following supplies non-repudiation during a forensics investigation?

A.
Dumping volatile memory contents first
Answers
A.
Dumping volatile memory contents first
B.
Duplicating a drive with dd
Answers
B.
Duplicating a drive with dd
C.
Using a SHA-2 signature of a drive image
Answers
C.
Using a SHA-2 signature of a drive image
D.
Logging everyone in contact with evidence
Answers
D.
Logging everyone in contact with evidence
E.
Encrypting sensitive data
Answers
E.
Encrypting sensitive data
Suggested answer: C

Explanation:

Using a SHA-2 signature of a drive image is a way to supply non-repudiation during a forensics investigation, as it can verify the integrity and authenticity of the data captured in the image. SHA-2 is a family of secure hash algorithms that can produce a unique and fixed-length digest of any input data. By hashing the drive image and comparing the signature with the original hash, the investigator can prove that the image has not been altered or tampered with since the time of acquisition. This can also help to identify the source of the data and prevent any denial from the suspect.

Reference:

https://www.skillsoft.com/course/comptia-security-incident-response-digital-forensics-supporting-investigations-f889a108-9721-4e2c-8e9e-b49b01295e48

asked 02/10/2024
Josefa Vera Gago
39 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first