A company has just experienced a data breach. The CEO wants to know what happened and whether legal action can be taken against the attacker. Which reason best explains why computer forensics is essential in this situation?

To update the company's firewall and antivirus software.

To immediately restore the affected systems and resume normal operations.

To identify the attacker's identity and gather evidence for prosecution.

To notify all customers about the breach as required by law.

A cybercrime investigator is examining a case of online identity theft. The suspect used a VPN and cryptocurrency to hide their tracks. What type of digital evidence is most likely to be crucial in this investigation?

The cryptocurrency wallet's private key stored on the suspect's device.

Logs from the VPN provider showing the suspect's real IP address.

The type of encryption used by the VPN.

The suspect's social media posts bragging about the crime.

A forensic examiner is asked to investigate a manager's computer for possible policy violations. The examiner is an employee of the same company and has access to the system. Which action is ethically and legally appropriate?

Only investigate the manager's personal files, not work-related files, to respect privacy.

Ensure the investigation is authorized by company policy and, if required, obtain legal approval.

Copy all data to a personal device for convenience, as the examiner is an employee.

Proceed with the investigation without informing the manager, as it is an internal matter.

What is an ethical obligation of a computer forensics investigator?

To use any means necessary to extract data, even if it damages the device.

To share findings with the public before the trial.

To remain objective and unbiased during the investigation.

To only investigate cases where the suspect is guilty.

Which statement best defines computer forensics?

The recovery of deleted files from storage media for personal data recovery purposes.

The process of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally acceptable.

The real-time monitoring of network traffic to block malicious activities.

The use of computer algorithms to predict future cyberattacks before they occur.

EC-CouncilComputer Hacking Forensic Investigator

Domain 1Objective 1

Computer Forensics in Today's World CHFI Practice Questions (Page 1)

Part of the Forensic Fundamentals and Process domain, which makes up ~14% of our current practice bank.

53questions here

11free pages

8concepts

Questions 1–5

1application · medium
A company has just experienced a data breach. The CEO wants to know what happened and whether legal action can be taken against the attacker. Which reason best explains why computer forensics is essential in this situation?
Select an answer first
2application · medium
A cybercrime investigator is examining a case of online identity theft. The suspect used a VPN and cryptocurrency to hide their tracks. What type of digital evidence is most likely to be crucial in this investigation?
Select an answer first
3application · medium
A forensic examiner is asked to investigate a manager's computer for possible policy violations. The examiner is an employee of the same company and has access to the system. Which action is ethically and legally appropriate?
Select an answer first
4foundation · easy
What is an ethical obligation of a computer forensics investigator?
Select an answer first
5foundation · easy
Which statement best defines computer forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.