Explain Digital Forensics and Attack Attribution Processes 100-160 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo encrypt the evidence for secure storage
   • BTo reduce the cost of the investigation
   • CTo speed up the forensic analysis process
   • DTo ensure the evidence is admissible in court
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company's legal team is preparing for a lawsuit involving a former employee who allegedly stole trade secrets. The IT department has a forensic image of the employee's laptop, but the original laptop has been returned to the employee. The legal team wants to ensure the forensic image is admissible as evidence. What is the most important factor to verify?

   • AThe forensic image was stored on a network share with restricted access.
   • BThe forensic image was created using the latest version of the forensic software.
   • CThe forensic image was compressed to save space.
   • DThe hash value of the forensic image matches the original drive's hash value recorded at the time of imaging.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of creating a forensic image of a storage device?

   • ATo create a backup for disaster recovery
   • BTo preserve the original device from any alteration during analysis
   • CTo speed up the analysis process
   • DTo compress the data to save storage space
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A digital forensics investigator is collecting evidence from a crime scene. The investigator has seized a smartphone and a laptop. To ensure the evidence is admissible in court, the investigator must maintain a chain of custody. Which action is a key component of maintaining the chain of custody?

   • AStoring the evidence in a secure evidence locker.
   • BTaking photographs of the evidence at the scene.
   • CLabeling the evidence with a unique identifier and documenting every transfer of custody.
   • DCreating a forensic image of the devices.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic analyst is called to investigate a suspected data breach on a server. The server is running and the analyst needs to collect evidence without altering it. The analyst has a write-blocker and forensic imaging software. What is the correct procedure to preserve the evidence?

   • APower off the server, remove the hard drive, connect it to a write-blocker, and create a forensic image.
   • BCopy the relevant files to an external drive and then hash the copy.
   • CRun the forensic imaging software directly on the running server to create an image.
   • DUse the server's built-in backup software to create a backup and use that as evidence.
   Reveal Solution Discussion Select an answer first