Computer Forensics CCT Practice Questions (Page 10)

Questions 46–50

1. 46foundation · easy

   Why is it important to document the collection of digital evidence?

   • ATo reduce the cost of the investigation
   • BTo speed up the investigation process
   • CTo ensure the evidence is admissible in court
   • DTo prevent unauthorized access to the evidence
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   An organization suspects an insider threat. The security team has identified a specific workstation that may contain evidence. The team wants to ensure the investigation is legally defensible. Which sequence of steps BEST follows the forensic investigation process?

   • AIdentify the evidence, preserve the scene, collect data, analyze, document, and report.
   • BCollect data first, then identify the evidence, and finally report.
   • CAnalyze the data, then collect additional data if needed, and then preserve the scene.
   • DReport findings immediately, then collect evidence to support the report.
   Reveal Solution Discussion Select an answer first
4. 48expert · hard

   A security team responds to a live intrusion on a domain controller. The attacker is currently active, and the team must decide whether to perform live acquisition or power down the system for static imaging. The organization needs to preserve evidence for prosecution but also wants to minimize further damage. What is the MOST appropriate decision?

   • AImmediately power down the system to stop the attacker and then image the disk.
   • BDisconnect the system from the network and then perform live acquisition.
   • CPerform live acquisition of memory and network connections, then power down and image the disk.
   • DKeep the system running and only monitor network traffic.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   During an incident response, an analyst suspects a malware process is running in memory and communicating with a command-and-control server. The analyst has access to the live system. Which action will provide the BEST evidence of this activity?

   • ARun 'netstat -an' and save the output to a file.
   • BSearch the hard drive for malware signatures.
   • CCapture a memory dump and analyze running processes and network connections.
   • DReview firewall logs for outbound connections.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A forensic investigator arrives at a crime scene where a suspect's laptop is powered on and the login screen is visible. The investigator needs to preserve the most volatile data first. Which action should the investigator take immediately?

   • APull the power cable and remove the battery to freeze the system state.
   • BDocument the screen contents with a photograph and then shut down the system normally.
   • CCreate a forensic image of the hard drive using a write blocker.
   • DCapture a live image of RAM using a trusted forensic tool.
   Reveal Solution Discussion Select an answer first