Digital Evidence and Forensic Readiness DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A system administrator discovers that an employee's workstation was used to access unauthorized files on a network share. The administrator wants to preserve potential evidence before the employee returns from lunch. Which action best preserves the integrity of the digital evidence?

   • ALog into the workstation and review the access logs.
   • BPower off the workstation immediately and remove the hard drive.
   • CCopy the relevant files to a USB drive and note the time.
   • DCreate a bit-for-bit forensic image of the hard drive using a write blocker.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which type of digital evidence is most likely to be found in a mobile device's SIM card?

   • ADeleted application cache files.
   • BGPS location history.
   • CWi-Fi network passwords.
   • DSubscriber identity and contact information.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A mid-sized company wants to be prepared for potential legal disputes involving employee emails and chat messages. They need to ensure that relevant data is preserved from the moment litigation is reasonably anticipated. Which forensic readiness step should they implement first?

   • ADelete old emails to reduce storage costs.
   • BTrain all employees on how to use email encryption.
   • CEstablish a legal hold policy that suspends routine deletion of relevant data.
   • DPurchase forensic imaging software for the IT team.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization wants to implement forensic readiness but has a limited budget. They must choose between investing in advanced forensic tools or training staff on evidence handling procedures. Which consideration should drive the decision?

   • AThe decision should be based on the cost of each option only.
   • BThe organization should purchase tools first and train later.
   • CTraining is more important because proper procedures prevent evidence from being compromised.
   • DTools are more important because they automate evidence collection.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which characteristic is essential for digital evidence to be admissible in court?

   • AIt must be authentic, reliable, and complete.
   • BIt must be stored on a device owned by the suspect.
   • CIt must be visible in the normal operating system interface.
   • DIt must be encrypted to protect its integrity.
   Reveal Solution Discussion Select an answer first