Isaca CISM Exam - Topic 3 Question 105 Discussion

Actual exam question for Isaca's CISM exam

Question #: 105
Topic #: 3

An incident handler is preparing a forensic image of a hard drive. Which of the following MUST be done to provide evidence that the image is an exact copy of the original?

APerform a manual verification of file counts.

BEncrypt and back up the hard drive before copying.

CUse the same hardware for the image as the original.

DPerform digital hashing of the original and the image.

Show Suggested Answer

Suggested Answer: D

by Barney at Nov 24, 2025, 06:54 AM

Limited Time Offer

25%

Off

Get Premium CISM Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lavera

1 month ago

Definitely D. Without hashing, it's not a valid copy.

upvoted 0 times

...

Michell

2 months ago

C seems unnecessary. Hardware doesn't matter as much.

upvoted 0 times

...

Berry

2 months ago

A is good, but not enough. D is a must for accuracy.

upvoted 0 times

...

Danica

2 months ago

But what about A? Manual checks can help too.

upvoted 0 times

...

Marti

2 months ago

Agreed, D is crucial for evidence. Can't skip that step.

upvoted 0 times

...

Melita

2 months ago

I think D is the best choice. Hashing proves integrity.

upvoted 0 times

...

Tambra

2 months ago

B is important for security, but not for proving it's an exact copy.

upvoted 0 times

...

Noel

3 months ago

Wait, do we really need to use the same hardware? Seems odd.

upvoted 0 times

...

Claudio

3 months ago

Totally agree with D! Can't skip hashing.

upvoted 0 times

...

Candra

3 months ago

Hashing? More like "smashing" it out of the park with that answer! D is the way to go.

upvoted 0 times

...

Donette

4 months ago

D) Hashing is the way to hash it out. No other option can guarantee the image is a true copy.

upvoted 0 times

...

Artie

4 months ago

D) Gotta love that digital hashing! It's the only surefire method to prove the image is legit.

upvoted 0 times

...

Barb

4 months ago

D) Definitely. Hashing is the way to go to verify the integrity of the forensic image.

upvoted 0 times

...

Kenny

4 months ago

I feel like using the same hardware might not be necessary, but I can’t recall the exact reasoning behind it.

upvoted 0 times

...

Lacey

4 months ago

I practiced a similar question where hashing was the key step. It seems like the best way to ensure integrity.

upvoted 0 times

...

Ciara

4 months ago

I’m not completely sure, but I remember something about verifying file counts being less reliable than hashing.

upvoted 0 times

...

Raina

5 months ago

I think digital hashing is crucial for proving the image is an exact copy, right? It’s like a fingerprint for the data.

upvoted 0 times

...

Truman

5 months ago

Verifying file counts manually? That doesn't sound very efficient or reliable. Digital hashing is definitely the way to go to validate the forensic copy.

upvoted 0 times

...

Ulysses

5 months ago

Using the same hardware seems like it could be important, but I'm not sure if that's an absolute requirement. The hashing is definitely the key piece to provide evidence of the forensic image.

upvoted 0 times

...

Carrol

5 months ago

I thought A was enough. Manual checks seem solid too.

upvoted 0 times

...

Ashlyn

5 months ago

Okay, I'm pretty confident that D is the right answer. Hashing the original and the image will give you a checksum to compare and prove they're identical.

upvoted 0 times

...

Lon

5 months ago

D) Perform digital hashing of the original and the image. This is the only way to ensure the forensic image is an exact copy.

upvoted 0 times

...

Corinne

6 months ago

D is the right answer! Hashing is crucial.

upvoted 0 times

...

Makeda

6 months ago

I'm a bit confused - is encrypting and backing up the drive before copying really necessary? Seems like extra steps that aren't directly related to verifying the image.

upvoted 0 times

...