Cisco 200-201 topic 1 question 350

What are two differences in how tampered and untampered disk images affect a security incident? (Choose two.)

A.
Tampered images are used in the security investigation process.
B.
Tampered images are used in the incident recovery process.
C.
The image is tampered if the stored hash and the computed hash match.
D.
Untampered images are used in the security investigation process.
E.
The image is untampered if the stored hash and the computed hash match.