Computer Forensics Investigation Process CHFI Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A forensic team is investigating a data breach involving a cloud-based storage service. The suspect is a former employee who had access to the company's cloud account. The legal team needs to preserve evidence without violating the cloud provider's terms of service. What is the BEST approach?

   • ALog into the suspect's cloud account and download all files to a local drive.
   • BAsk the cloud provider to preserve the account data and obtain a legal hold or court order.
   • CSeize the suspect's personal computer and hope that cloud data is cached locally.
   • DUse the cloud provider's API to create a snapshot of the account's data.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   After imaging a suspect's hard drive, an analyst computes a SHA-256 hash of the image. What is the primary purpose of this step?

   • ATo index the files in the image for faster searching.
   • BTo verify that the image is an exact copy of the original drive.
   • CTo encrypt the image to protect it from unauthorized access.
   • DTo compress the image so it takes up less storage space.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A forensic analyst has completed the examination of a suspect's laptop and is preparing to hand the evidence to the legal team. Which practice is essential to maintain the chain of custody?

   • AErase the suspect's personal files to protect privacy before handing over the laptop.
   • BKeep the laptop in the analyst's locked drawer until the trial date.
   • CDocument every person who handled the evidence and the time and purpose of each transfer.
   • DMake a copy of the hard drive and give the original to the defense attorney.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A forensic examiner is preparing a report for a case involving a disputed contract. The report must be understandable to a jury that includes non-technical members. Which approach is most effective?

   • AUse analogies and plain language to explain complex technical findings.
   • BFocus only on the final conclusion and omit the methodology.
   • CInclude a detailed technical appendix and use technical terms throughout the main body.
   • DWrite the report in a narrative style without headings or visual aids.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Before testifying as an expert witness, what should a computer forensics investigator review to ensure the testimony is accurate?

   • AThe legal strategies of the prosecution
   • BThe personal background of the defense attorney
   • CThe investigation report and all related evidence documentation
   • DThe suspect's social media profiles
   Reveal Solution Discussion Select an answer first