nerdexam
Cisco

200-201 · Question #544

While analyzing the process of a recent breach case, a forensic investigator determined that an external USB drive was connected to the laptop of the HR manager and personal data of employees was exfi

The correct answer is B. direct evidence. Direct evidence is obtained through firsthand observation and directly links a person or action to the incident. The video showing the stranger handing the USB drive to the HR manager provides direct visual proof of the act involved in the breach.

Submitted by thandi_sa· Mar 6, 2026Security Policies and Procedures

Question

While analyzing the process of a recent breach case, a forensic investigator determined that an external USB drive was connected to the laptop of the HR manager and personal data of employees was exfiltrated to an external source. Video surveillance showed a stranger giving this USB drive to an HR manager during a job interview. How must this type of evidence be categorized?

Options

  • Abest evidence
  • Bdirect evidence
  • Cindirect evidence
  • Dcorroborative evidence

How the community answered

(23 responses)
  • A
    4% (1)
  • B
    83% (19)
  • C
    4% (1)
  • D
    9% (2)

Explanation

Direct evidence is obtained through firsthand observation and directly links a person or action to the incident. The video showing the stranger handing the USB drive to the HR manager provides direct visual proof of the act involved in the breach.

Topics

#Digital forensics#Evidence categories#Incident response#Data exfiltration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 200-201 Practice