Computer Forensics and Incident Response ACCISO Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A forensic examiner must image a large RAID server that is part of an investigation. The server cannot be powered off because it is a production system. Which approach is most appropriate?

   • AUse a hardware write-blocker and image the RAID controller's logical volume.
   • BPower off the server and image each physical disk separately.
   • CCopy the data over the network using a forensic tool.
   • DPerform a live acquisition using forensic tools that capture the logical volume.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A forensic examiner is working on a case involving a company employee accused of stealing trade secrets. The examiner has collected a forensic image of the employee's work computer. During analysis, the examiner finds personal emails and photos unrelated to the case. What is the examiner's ethical obligation?

   • AInclude all personal data in the report to provide a complete picture.
   • BDocument the existence of the unrelated data but do not include it in the report or use it in the investigation.
   • CShare the personal data with the employer since they own the computer.
   • DDelete the personal data to protect the employee's privacy.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic analyst needs to acquire the contents of a suspect's smartphone for evidence. The phone is locked with a PIN, and the analyst has a warrant. Which tool or technique is most appropriate for acquiring a bit-for-bit image of the phone's storage?

   • ARemove the memory chip from the phone and read it with a chip-off reader.
   • BUse a write-blocker and connect the phone as a USB mass storage device.
   • CUse a commercial mobile forensic tool that supports logical or physical acquisition via the phone's debugging interface.
   • DConnect the phone to a computer and copy the visible files using the file manager.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is the most important action to preserve the integrity of digital evidence during collection?

   • AEncrypting the evidence after collection
   • BUsing a write-blocker when creating a forensic image
   • CMaking multiple copies of the evidence
   • DStoring the evidence in a fireproof safe
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After a data breach, the incident response team must produce a report for senior management and legal counsel. What is the most important characteristic of this report?

   • AIt focuses on remediation steps and future prevention measures.
   • BIt clearly distinguishes facts from analysis and includes a timeline of events.
   • CIt contains all technical details and raw log data for the technical team.
   • DIt is written in legal jargon to satisfy the legal team.
   Reveal Solution Discussion Select an answer first