A forensic examiner receives a smartphone that is powered on and locked with a PIN. The phone is evidence in a harassment case. The examiner needs to extract data while preserving evidence integrity. What is the BEST approach?

Connect the phone to a computer and browse the file system normally.

Place the phone in a Faraday bag and attempt to bypass the lock using forensic tools.

Remove the SIM card and microSD card first.

Power off the phone immediately to prevent data changes.

What is the purpose of hashing digital evidence during collection?

To compress the evidence to save storage space

To create a unique digital fingerprint to verify the evidence has not been altered

To index the evidence for faster searching

To encrypt the evidence to protect it from unauthorized access

What type of metadata is commonly found in file systems and used in forensic analysis?

The password of the user who created the file

The IP address of the computer that created the file

Timestamps such as creation, modification, and access times

The exact GPS location where the file was created

What is steganography?

The method of securely deleting files

The practice of hiding data within other data, such as embedding a message in an image

The process of encrypting data to make it unreadable

The technique of recovering deleted files

What type of data is stored on a SIM card that is useful in mobile device forensics?

Subscriber identity and contacts

The device's GPS location history

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 2

Computer Forensics CCT Practice Questions (Page 2)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

56questions here

12free pages

13concepts

Questions 6–10

6application · medium
A forensic examiner receives a smartphone that is powered on and locked with a PIN. The phone is evidence in a harassment case. The examiner needs to extract data while preserving evidence integrity. What is the BEST approach?
Select an answer first
7foundation · easy
What is the purpose of hashing digital evidence during collection?
Select an answer first
8foundation · easy
What type of metadata is commonly found in file systems and used in forensic analysis?
Select an answer first
9foundation · easy
What is steganography?
Select an answer first
10foundation · easy
What type of data is stored on a SIM card that is useful in mobile device forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.