Computer Forensics Investigation Process CHFI Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An examiner is analyzing a forensic image of a computer involved in a phishing attack. The examiner finds a suspicious executable file that appears to be the malware. The examiner needs to determine the malware's behavior without infecting the analysis environment. What is the BEST approach?

   • ARun the executable directly on the examiner's workstation to observe its behavior.
   • BUse a virtual machine with network isolation to execute the malware and monitor its actions.
   • CDisassemble the executable using a debugger to analyze its code without executing it.
   • DUpload the executable to an online malware analysis service.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an essential element of a well-written forensic investigation report?

   • AThe personal opinions of the investigator about the suspect's guilt
   • BA list of all the passwords used by the suspect
   • CThe exact GPS coordinates of the crime scene
   • DA clear description of the actions taken during the investigation
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An examiner is analyzing a forensic image of a suspect's hard drive. The examiner finds a file that appears to be a deleted spreadsheet containing financial records. What is the BEST way to recover and analyze this file?

   • ASearch the file system's journal for the file's content.
   • BUse a data carving tool to recover the file from unallocated space.
   • CRestore the file from the Recycle Bin on the original drive.
   • DAsk the suspect for the file's password.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a potential source of digital evidence that should be considered during the identification phase of an investigation?

   • AThe weather conditions at the time of the incident
   • BNetwork logs from routers and firewalls
   • CThe physical layout of the crime scene
   • DThe suspect's body language during questioning
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When securing a crime scene that contains a running computer, which of the following actions is most appropriate for a first responder to take?

   • APhotograph the screen and then pull the power cord from the wall outlet
   • BLeave the computer running and wait for the forensic examiner to arrive
   • CUnplug the network cable and then use the computer to copy important files to a USB drive
   • DImmediately shut down the computer using the operating system's shutdown option
   Reveal Solution Discussion Select an answer first