Eccouncil 212-89 Exam - Topic 4 Question 42 Discussion

Actual exam question for Eccouncil's 212-89 exam

Question #: 42
Topic #: 4

[All 212-89 Questions]

Bit stream image copy of the digital evidence must be performed in order to:

APrevent alteration to the original disk

BCopy the FAT table

CCopy all disk sectors including slack space

DAll the above

Show Suggested Answer

Suggested Answer: C

by Mireya at Apr 01, 2023, 08:44 AM

Limited Time Offer

25%

Off

Get Premium 212-89 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jennifer

4 months ago

Totally agree, it's crucial for preserving evidence!

upvoted 0 times

...

Xochitl

4 months ago

Wait, can a bit stream really capture everything? Sounds too good to be true.

upvoted 0 times

...

Ligia

4 months ago

All the above makes sense, right?

upvoted 0 times

...

Nada

4 months ago

I think it's also about copying all disk sectors, including slack space.

upvoted 0 times

...

Alona

4 months ago

Definitely to prevent alteration to the original disk!

upvoted 0 times

...

Miss

5 months ago

I’m a bit confused; I thought slack space was important, but I can’t remember if that means we need to choose C or D.

upvoted 0 times

...

Hannah

5 months ago

I feel like we practiced a question similar to this, and I think the answer was D because it covers all aspects of imaging.

upvoted 0 times

...

Alba

5 months ago

I’m not entirely sure, but I think copying the FAT table is important too, which makes me wonder if it could be B.

upvoted 0 times

...

Domitila

5 months ago

I remember we discussed how creating a bit stream image is crucial to prevent any changes to the original disk, so I think A might be correct.

upvoted 0 times

...

Krissy

5 months ago

Easy peasy! For this type of situation, I'd definitely go with option B and mark the session as inactive. That's the most efficient way to handle it when a customer suddenly stops responding.

upvoted 0 times

...

Laurel

5 months ago

I'm a bit confused on the difference between risk appetite and risk categories. I'll have to review those concepts again before answering this.

upvoted 0 times

...

Micah

5 months ago

I think the deployment mode could be "distributed," but I can't remember all the specifics of that configuration.

upvoted 0 times

...

Marjory

5 months ago

Okay, I think I've got a handle on this. The key is to identify which statement doesn't align with Quinn's ideas about strategy development.

upvoted 0 times

...