A security consultant has been asked to recommend best practices for preserving digital evidence. Which of the following can be used to show the evidence has not been tampered with?

The correct answer is C. Hash value. A cryptographic hash (e.g., SHA-256) produces a unique fingerprint of a digital file. By computing and securely storing the hash at collection time, and then recomputing it before presentation, you prove the evidence hasn’t changed, since any modification would alter the hash.

Submitted by javi_es· Mar 6, 2026Security Operations

Question

Options

ALegal hold
BChecksum
CHash value
DE-discovery

How the community answered

(53 responses)

A
2% (1)
B
6% (3)
C
89% (47)
D
4% (2)

Explanation

A cryptographic hash (e.g., SHA-256) produces a unique fingerprint of a digital file. By computing and securely storing the hash at collection time, and then recomputing it before presentation, you prove the evidence hasn’t changed, since any modification would alter the hash.

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice