A forensic lab is considering adding AI-based analysis tools to speed up investigations. However, they are concerned about the admissibility of AI-generated findings in court. What should the lab do to address this concern?

Use AI tools but ensure that a qualified examiner validates the results before presenting them in court.

Avoid AI tools entirely because they are not accepted in court.

Use AI tools and present the results without human review to save time.

Only use AI tools for internal purposes and never present their findings in court.

Why is encryption a challenge in computer forensics?

It can render data unreadable without the proper key.

It is illegal for investigators to encounter encrypted data.

It prevents the creation of forensic images.

It makes data permanently disappear from the storage device.

A company's security team detects a potential data breach. The incident response team is called to contain the threat and restore services. Meanwhile, the legal department is concerned about potential litigation and wants to preserve evidence. The incident response team begins by isolating the affected systems and collecting volatile data. Which statement best describes the relationship between incident response and computer forensics in this scenario?

Incident response and computer forensics are identical disciplines with the same objectives.

Incident response is focused on containment and eradication, while computer forensics is focused on evidence preservation and analysis.

Computer forensics is a subset of incident response that only deals with malware analysis.

Incident response is only concerned with restoring services, and forensics is only concerned with legal proceedings.

A forensic lab is considering investing in new tools to handle cases involving encrypted messaging apps. The lab director notes that many apps use end-to-end encryption and store data only on the device. Which approach is most likely to yield useful evidence in such cases?

Perform a physical acquisition of the mobile device and analyze the app's local database.

Intercept the network traffic during a live conversation.

Rely on cloud backups of the app data.

Request the encryption keys from the app provider.

Which development is most associated with the early evolution of computer forensics?

The creation of the first personal computers in the 1970s.

The development of cloud computing in the 2000s.

The introduction of mobile devices in the 2000s.

The invention of the internet in the 1990s.

EC-CouncilComputer Hacking Forensic Investigator

Domain 1Objective 1

Computer Forensics in Today's World CHFI Practice Questions (Page 5)

Part of the Forensic Fundamentals and Process domain, which makes up ~14% of our current practice bank.

53questions here

11free pages

8concepts

Questions 21–25

21expert · hard
A forensic lab is considering adding AI-based analysis tools to speed up investigations. However, they are concerned about the admissibility of AI-generated findings in court. What should the lab do to address this concern?
Select an answer first
22foundation · easy
Why is encryption a challenge in computer forensics?
Select an answer first
23expert · hard
A company's security team detects a potential data breach. The incident response team is called to contain the threat and restore services. Meanwhile, the legal department is concerned about potential litigation and wants to preserve evidence. The incident response team begins by isolating the affected systems and collecting volatile data. Which statement best describes the relationship between incident response and computer forensics in this scenario?
Select an answer first
24expert · hard
A forensic lab is considering investing in new tools to handle cases involving encrypted messaging apps. The lab director notes that many apps use end-to-end encryption and store data only on the device. Which approach is most likely to yield useful evidence in such cases?
Select an answer first
25foundation · easy
Which development is most associated with the early evolution of computer forensics?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CHFI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CHFI” is a trademark of its owner, used for identification only.