A forensic examiner is investigating a case involving a company laptop that was used to access a competitor's confidential data. The laptop is running and the user is still logged in. The examiner has a warrant to seize the laptop. The company's legal counsel wants to minimize business disruption, but the examiner must preserve evidence. The laptop is encrypted with BitLocker, and the user is logged in. What is the BEST course of action?

Ask the user to provide the BitLocker recovery key, then shut down and image the drive.

Immediately shut down the laptop and remove the hard drive for imaging.

Copy the user's open files to an external drive and then seize the laptop.

Capture a memory dump and then create a forensic image of the running system using a live acquisition tool.

A forensic examiner arrives at a crime scene where a suspect's laptop is powered on and showing an open email client. The examiner needs to preserve evidence for court. Which action best balances evidentiary integrity with the need to capture volatile data?

Photograph the screen, then pull the power cord and remove the battery before transporting the laptop.

Immediately shut down the laptop using the operating system's shutdown menu.

Unplug the network cable and leave the laptop running until the forensic team arrives.

Copy the email client's data folder to a USB drive before turning off the laptop.

An incident responder is collecting a hard drive from a server that was involved in a security incident. The drive is still installed in the server. What is the proper method to collect the drive for forensic analysis?

Copy the drive's contents to an external drive while the server is still running.

Power off the server, remove the drive, and connect it to a forensic workstation using a write-blocker.

Remove the drive and connect it directly to a forensic workstation without a write-blocker.

Use the server's backup software to create a backup of the drive.

What is the primary goal of the containment phase in incident response?

To prevent the incident from spreading and causing further damage

To restore systems to their normal operation

To collect evidence for legal proceedings

To identify the root cause of the incident

During an internal investigation, an HR manager asks the forensic team to examine an employee's work computer without prior approval. The company's policy requires management authorization for such examinations. What should the forensic team do?

Refuse to examine the computer until proper authorization is obtained.

Examine the computer but do not document the authorization.

Proceed with the examination because the request came from HR.

Ask the employee for permission first.

EC-CouncilAssociate C|CISO

Domain 4Objective 8

Computer Forensics and Incident Response ACCISO Practice Questions (Page 7)

Part of the Information Security Core Competencies domain, which makes up ~31% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~16–25 in this domain), expect 2–3 from this objective — we provide 62 practice questions to prepare you well beyond it. (estimate)

62questions here

13free pages

11concepts

11 Concepts in This Objective

Computer Forensics Fundamentals
Forensic Process and Procedures
Evidence Collection and Preservation
Forensic Imaging and Duplication
Data Recovery and Analysis
Incident Response Fundamentals
Incident Detection and Triage
Containment, Eradication, and Recovery
Legal and Ethical Considerations
Forensic Tools and Technologies
Reporting and Documentation

Questions 31–35

31expert · hard
A forensic examiner is investigating a case involving a company laptop that was used to access a competitor's confidential data. The laptop is running and the user is still logged in. The examiner has a warrant to seize the laptop. The company's legal counsel wants to minimize business disruption, but the examiner must preserve evidence. The laptop is encrypted with BitLocker, and the user is logged in. What is the BEST course of action?
Select an answer first
32application · medium
A forensic examiner arrives at a crime scene where a suspect's laptop is powered on and showing an open email client. The examiner needs to preserve evidence for court. Which action best balances evidentiary integrity with the need to capture volatile data?
Select an answer first
33application · medium
An incident responder is collecting a hard drive from a server that was involved in a security incident. The drive is still installed in the server. What is the proper method to collect the drive for forensic analysis?
Select an answer first
34foundation · easy
What is the primary goal of the containment phase in incident response?
Select an answer first
35application · medium
During an internal investigation, an HR manager asks the forensic team to examine an employee's work computer without prior approval. The company's policy requires management authorization for such examinations. What should the forensic team do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ACCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ACCISO” is a trademark of its owner, used for identification only.