Digital Evidence and Forensic Readiness DFE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An investigator needs to prove that a file on a seized computer has not been modified since collection. Which method is most appropriate?

   • ANote the file size and date modified.
   • BTake a photograph of the file properties.
   • CCalculate a cryptographic hash of the file and record it.
   • DCopy the file to a CD and store it.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company wants to ensure that digital evidence is available for future investigations. Which action is a key component of forensic readiness?

   • ADisable logging to protect user privacy.
   • BStore all data on encrypted drives with no backups.
   • CAllow employees to delete logs as needed.
   • DImplement centralized logging and retention policies.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's forensic readiness plan requires that all evidence be preserved for at least two years. However, the legal department says that some data must be deleted after one year due to privacy regulations. How should the company resolve this conflict?

   • AImplement a data classification policy that applies different retention periods based on data type.
   • BIgnore the privacy regulations because forensic readiness is more important.
   • CKeep all data for two years to comply with the forensic readiness plan.
   • DDelete all data after one year to comply with privacy regulations.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A system administrator discovers that an employee's workstation has been used to access unauthorized file-sharing sites. The administrator needs to preserve potential evidence while the machine is still running. Which action best supports forensic preservation at this stage?

   • AImmediately power off the machine to prevent any further changes to the disk
   • BCapture a bit-for-bit image of the hard drive using a write-blocker
   • CRecord the current date, time, and running processes, then disconnect the machine from the network
   • DCopy all user files to a network share for safekeeping
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which ethical obligation is most important for a digital forensics examiner?

   • ATo share findings with the media to ensure public transparency.
   • BTo present findings in a way that supports the prosecution's case.
   • CTo maintain objectivity and avoid bias in the analysis and reporting of evidence.
   • DTo use the most advanced tools available to ensure accuracy.
   Reveal Solution Discussion Select an answer first