Digital Evidence and Forensic Readiness DFE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which legal principle is most directly relevant when collecting digital evidence from an employee's company-owned computer?

   • AThe organization must have a legal basis, such as consent, policy, or a warrant, to access the data.
   • BThe employee's right to privacy is absolute and cannot be waived.
   • CThe organization can collect any data without restriction because it owns the device.
   • DThe employee must be notified before any data is collected.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's HR department suspects an employee of leaking confidential documents. The legal team wants to collect evidence from the employee's company-issued laptop. Which action is most consistent with legal and ethical considerations?

   • AReview the company's acceptable-use policy and employee consent agreements before collecting any data
   • BAsk the employee to voluntarily hand over the laptop and any personal devices
   • CRemotely wipe the laptop to prevent further data leakage
   • DSeize the laptop and image it immediately without notifying the employee
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   A company's forensic readiness plan includes logging all network connections. Which type of digital evidence does this plan primarily generate?

   • ACloud-based evidence
   • BComputer-based evidence
   • CNetwork-based evidence
   • DMobile device evidence
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which action is a key principle of preserving digital evidence at a crime scene?

   • ACopying files from the device to a USB drive for analysis.
   • BImmediately disconnecting the device from the network and power.
   • CRunning antivirus software to ensure the device is clean.
   • DPowering on the computer to check for running processes.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a key component of a forensic readiness policy?

   • ASpecifying the exact forensic tools to be used in every investigation.
   • BRequiring that all employees have access to forensic software.
   • CDefining the roles and responsibilities of personnel involved in evidence handling.
   • DGuaranteeing that all evidence will be admissible in court.
   Reveal Solution Discussion Select an answer first