| Exam 200-201 | Question id=6060 | Security policies and procedures |
What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)
| A. |
Untampered images are used in the security investigation process | |
| B. |
Tampered images are used in the security investigation process | |
| C. |
The image is tampered if the stored hash and the computed hash match | |
| D. |
Tampered images are used in the incident recovery process | |
| E. |
The image is untampered if the stored hash and the computed hash match |