Free Cisco 200-201 Actual Exam Questions - Question 3 Discussion

C. Labeling and recording evidence has to happen right when you collect it to make sure everything stays legit. If you wait until examination or reporting, there’s a risk the data could get mixed up or tampered with. Preservation starts from the moment you handle the evidence.

It’s C for sure. Labeling and recording happen as soon as you collect the data; you can’t wait until examination or reporting without risking contamination or losing the chain of custody.

Maybe C makes more sense since preserving integrity starts as soon as you pick up the evidence. Labeling later could lead to confusion or contamination.

C/D? The labeling part definitely happens during collection to secure evidence, but the formal recording that preserves integrity might also be detailed during reporting. Could be a bit of both phases.

Option C makes the most sense because you have to label and record evidence as you pick it up to make sure nothing gets confused later. Doing this after collection risks messing up the evidence chain.

This one feels like C. Labeling and recording evidence right when you collect it is key to keeping that chain of custody solid. If you wait until the investigation or reporting, there’s a risk things get mixed up or lost. So it makes more sense to do it during collection, not later.

B imo, while collection involves physical handling, the actual labeling and detailed recording tied to a specific event might happen during the investigation when everything’s being pieced together.

C imo, labeling is crucial right at collection to avoid any evidence mix-up later.

Probably C. The key part is preserving evidence integrity right when you gather it, so labeling and recording should happen during collection to keep everything organized from the start.

C/D? I get why C makes sense since you need to label and record as you collect to avoid mix-ups. But some of the detailed recording might actually happen during reporting, where you formally document everything for the case. Still, preserving integrity is usually a chain-of-custody thing that starts right at collection, so C feels more accurate. D is more about summarizing findings than initial labeling.

Guessing C here too. Labeling and recording data happens as you collect it to make sure nothing gets mixed up or lost before you analyze it. Investigation is more about figuring out what to look for, not preserving evidence.

Probably C. The collection phase should be when data is labeled and recorded carefully to keep its integrity intact. If it’s not documented correctly right away, the evidence could get compromised before examination or reporting happens. Seems pretty straightforward to me.