Computer Forensics in Today's World CHFI Practice Questions (Page 10)

Questions 46–50

1. 46application · medium

   A company's server is infected with malware that is exfiltrating data. The incident response team is called to contain the infection, while the legal team wants to preserve evidence for a potential lawsuit. The incident response team wants to wipe the server and reinstall the operating system. What is the best course of action?

   • ACreate a forensic image of the server before wiping it.
   • BAsk the legal team to decide without involving forensic experts.
   • CDisconnect the server from the network and leave it powered on.
   • DWipe the server immediately to stop the data exfiltration.
   Reveal Solution Discussion Select an answer first
2. 47application · medium

   A company is investigating a case of intellectual property theft. The suspect has deleted files and used a file-shredding tool. Why is computer forensics essential in this case?

   • ATo ensure the company's firewall is updated to prevent future theft.
   • BTo monitor the suspect's future activities.
   • CTo recover deleted data that may still be present on the storage media.
   • DTo immediately reinstall the operating system to remove any malicious software.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   In today's digital world, computer forensics primarily serves which role?

   • ASupporting legal proceedings by providing reliable digital evidence.
   • BManaging user access permissions in an organization.
   • CDesigning firewalls to prevent unauthorized access.
   • DDeveloping new encryption algorithms to secure data.
   Reveal Solution Discussion Select an answer first
5. 49application · medium

   A small business owner suspects an employee of leaking confidential data. The owner wants to examine the employee's work computer. What is the most appropriate first step from a computer forensics perspective?

   • ACreate a forensic image of the hard drive before any analysis.
   • BInstall monitoring software to track future activity.
   • CAsk the employee to explain the files on the computer.
   • DTurn on the computer and search for the leaked files.
   Reveal Solution Discussion Select an answer first
6. 50application · medium

   A company's server is compromised. The IT team quickly isolates the server and begins collecting logs and memory dumps to understand the attack. Later, the legal department requests all relevant data for a potential lawsuit. Which statement correctly distinguishes computer forensics from incident response and e-discovery?

   • AIncident response focuses on containment and eradication, while forensics focuses on evidence preservation and analysis.
   • BComputer forensics is only used after a criminal case is filed, not during an active incident.
   • CE-discovery is the same as computer forensics but performed only by law enforcement.
   • DIncident response and computer forensics are identical and can be performed by the same team without any conflict.
   Reveal Solution Discussion Select an answer first