Digital Evidence and Forensic Readiness DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   An investigator is documenting evidence from a network intrusion. Which item is considered digital evidence?

   • AA handwritten note from the administrator describing the incident
   • BA printed copy of the firewall logs
   • CThe firewall's configuration file stored on the device
   • DThe physical network cable used to connect the firewall
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   A forensic investigator is examining a USB drive found at a crime scene. Which characteristic of the data on the USB drive makes it digital evidence?

   • AIt is visible to the naked eye
   • BIt is owned by the suspect
   • CIt is stored in binary format that can be interpreted by a computer
   • DIt is physically located at the crime scene
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An investigator is examining a smartphone seized from a suspect. Which type of data is considered volatile and may be lost if the device is powered off?

   • AText messages stored in the phone's internal memory
   • BThe device's IMEI number
   • CPhotos saved to the SD card
   • DThe device's current GPS location
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A multinational company must comply with data protection laws that require personal data to be stored in specific countries. Their forensic readiness plan involves collecting evidence from servers in multiple regions. What is the primary legal consideration?

   • AIgnore local laws because the company is headquartered elsewhere.
   • BUse encryption to avoid legal restrictions.
   • CEnsure that evidence collection and transfer comply with cross-border data transfer regulations.
   • DCollect only data that is stored in the company's home country.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In the context of a forensic investigation, which statement best defines digital evidence?

   • APhysical items such as hard drives, USB drives, and mobile phones seized at a crime scene.
   • BAny information of probative value that is stored or transmitted in binary form and can be used in a legal proceeding.
   • CData that is only found on a computer's hard drive and is visible to the operating system.
   • DOnly data that has been encrypted or hidden by a suspect to conceal criminal activity.
   Reveal Solution Discussion Select an answer first