A forensic investigator is called to the office of a terminated employee. The HR manager hands over the employee's laptop, which is still running and shows an open email client. The investigator needs to preserve evidence for a potential lawsuit. Which action should the investigator take FIRST?

Create a forensic image of the hard drive using a write blocker.

Capture the contents of RAM and running processes before touching the hard drive.

Remove the hard drive and connect it to a forensic workstation.

Immediately shut down the laptop by holding the power button.

What is a key requirement for a forensic report to be legally acceptable?

It must be written in a technical language that only experts understand

It must clearly document the methods used and the findings

It must include the investigator's personal opinion about the suspect's guilt

What is a key advantage of static acquisition?

It minimizes changes to the original evidence

It can be performed without specialized tools

It is the only method that can capture data from encrypted drives

It captures volatile data that would otherwise be lost

During a forensic investigation, an analyst transfers a seized USB drive from the evidence locker to the lab. The analyst forgets to log the transfer. Later, the defense attorney questions the authenticity of the evidence. What is the MOST likely consequence?

The chain of custody is broken, and the evidence's integrity may be challenged in court.

The evidence is automatically excluded from court.

The analyst will be personally liable for criminal charges.

The evidence can still be used if the analyst testifies that no tampering occurred.

Why is it important to isolate a mobile device from the network during forensic acquisition?

To ensure the device's battery does not drain

To speed up the data extraction process

To allow the device to connect to a computer via USB

To prevent remote wiping or data alteration

EC-CouncilCertified Cybersecurity Technician

Domain 7Objective 2

Computer Forensics CCT Practice Questions (Page 4)

Part of the Incident Response and Computer Forensics domain, which makes up ~10% of our current practice bank.

56questions here

12free pages

13concepts

Questions 16–20

16application · medium
A forensic investigator is called to the office of a terminated employee. The HR manager hands over the employee's laptop, which is still running and shows an open email client. The investigator needs to preserve evidence for a potential lawsuit. Which action should the investigator take FIRST?
Select an answer first
17foundation · easy
What is a key requirement for a forensic report to be legally acceptable?
Select an answer first
18foundation · easy
What is a key advantage of static acquisition?
Select an answer first
19application · medium
During a forensic investigation, an analyst transfers a seized USB drive from the evidence locker to the lab. The analyst forgets to log the transfer. Later, the defense attorney questions the authenticity of the evidence. What is the MOST likely consequence?
Select an answer first
20foundation · easy
Why is it important to isolate a mobile device from the network during forensic acquisition?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCT” is a trademark of its owner, used for identification only.