Computer Forensics in Today's World CHFI Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A forensic lab is updating its procedures to handle modern cases. They notice that many investigations now involve cloud-stored data, encrypted containers, and anti-forensic techniques. Which approach best reflects the evolution of computer forensics and current trends?

   • ARely solely on traditional disk imaging and file carving techniques.
   • BFocus only on network forensics because most crimes now occur over the network.
   • COutsource all forensic work to cloud providers to avoid handling encrypted data.
   • DIncorporate memory forensics, cloud forensics, and encryption analysis into the standard workflow.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Why is computer forensics essential in modern investigations?

   • ABecause it is required by law for all corporate data breaches.
   • BBecause it replaces the need for witness testimony.
   • CBecause digital devices often contain crucial evidence of criminal activity.
   • DBecause it can automatically convict suspects without a trial.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is working on a case where the suspect is a public figure. The media is pressuring for information about the investigation. What is the ethical obligation of the examiner?

   • AMaintain confidentiality and only share information with authorized parties.
   • BLeak information to a trusted journalist to ensure accurate reporting.
   • CShare non-sensitive details to satisfy the media's request.
   • DProvide general updates to the media to maintain public trust.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company has been sued by a former employee for discrimination. The legal team needs to produce all relevant emails and documents. Meanwhile, the IT team discovers a malware infection on the same server that stores the emails. What is the most appropriate course of action?

   • AFocus only on e-discovery and ignore the malware because it is not related to the lawsuit.
   • BNotify the court that the emails are unavailable due to the malware infection.
   • CConduct a forensic investigation of the malware, then perform e-discovery on a forensic image of the server.
   • DImmediately wipe the server to remove the malware, then produce the emails from backups.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has just experienced a ransomware attack. The IT team is restoring systems from backups, while the legal team is preparing to notify regulators. The CEO asks for a forensic investigation to determine how the attack occurred. Which statement correctly describes the relationship between these activities?

   • AThe IT team's restoration is more important than forensics, so the investigation can wait.
   • BForensics should be conducted before any system restoration to preserve evidence.
   • CE-discovery is the appropriate process because regulators require notification.
   • DIncident response and forensics are the same, so the IT team's actions are sufficient for the investigation.
   Reveal Solution Discussion Select an answer first