What type of information can be found in file system metadata?

The IP address of the computer that created the file

The file's creation, modification, and access timestamps

What is the primary function of a forensic tool like Autopsy?

To manage incident response workflows

To monitor network traffic for intrusions

To analyze disk images and extract evidence

To scan for vulnerabilities in web applications

An incident response team has completed an investigation and must write a report for both executive management and legal counsel. The report must be concise but complete. Which approach is most appropriate?

Write a report using only technical jargon to demonstrate expertise.

Write a brief report with only the final conclusion.

Write a single detailed report with all technical findings.

Write two reports: an executive summary and a detailed technical report.

A forensic examiner is documenting evidence collected from a compromised server. The examiner needs to ensure the evidence is admissible in court. Which documentation practice is most critical?

Use a forensic tool to generate a report of the analysis.

Take photographs of the server room and the equipment.

Store the evidence in a locked cabinet with limited access.

Record every person who handled the evidence and the time and purpose of each transfer.

EC-CouncilAssociate C|CISO

Domain 4Objective 8

Computer Forensics and Incident Response ACCISO Practice Questions (Page 11)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

11concepts

11 Concepts in This Objective

Computer Forensics Fundamentals
Forensic Process and Procedures
Evidence Collection and Preservation
Forensic Imaging and Duplication
Data Recovery and Analysis
Incident Response Fundamentals
Incident Detection and Triage
Containment, Eradication, and Recovery
Legal and Ethical Considerations
Forensic Tools and Technologies
Reporting and Documentation

Questions 51–55

51foundation · easy
What type of information can be found in file system metadata?
Select an answer first
52foundation · easy
During which phase of a forensic investigation does the investigator create a bit-for-bit copy of the storage media?
Select an answer first
53foundation · easy
What is the primary function of a forensic tool like Autopsy?
Select an answer first
54expert · hard
An incident response team has completed an investigation and must write a report for both executive management and legal counsel. The report must be concise but complete. Which approach is most appropriate?
Select an answer first
55application · medium
A forensic examiner is documenting evidence collected from a compromised server. The examiner needs to ensure the evidence is admissible in court. Which documentation practice is most critical?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.