Digital Evidence and Forensic Readiness DFE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An investigator is analyzing a compromised web server. The server's access logs show requests from an IP address that is later found to be a Tor exit node. The investigator also finds a suspicious file in the web root. Which combination of evidence is most probative for identifying the attacker?

   • AThe suspicious file's content, since it may contain the attacker's identity
   • BThe access logs and the suspicious file's creation timestamp
   • CThe server's system logs, which may show the attacker's local username
   • DThe IP address alone, since it identifies the attacker
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An investigator is examining a suspect's computer and finds a temporary internet file that contains a fragment of a deleted email. Which characteristic of digital evidence does this illustrate?

   • ADigital evidence is fragile and can be easily altered or destroyed.
   • BDigital evidence is only found on the primary storage device.
   • CDigital evidence is permanent and cannot be deleted.
   • DDigital evidence is always stored in its original form.
   Reveal Solution Discussion Select an answer first
4. 28application · easy

   A forensic analyst is documenting the chain of custody for a seized hard drive. Which information is essential to include in the documentation?

   • AThe color of the hard drive's label
   • BThe name of every person who handled the evidence and when
   • CThe purchase price of the hard drive
   • DThe brand and model of the hard drive
   Reveal Solution Discussion Select an answer first
5. 29application · easy

   During an investigation of a data breach, an analyst finds relevant chat logs on a company server, a suspect's smartphone, and a network firewall's connection logs. Which statement correctly characterizes these sources?

   • AOnly the server and smartphone are valid evidence; firewall logs are not digital evidence.
   • BAll three are digital evidence sources that may contain relevant data.
   • CThe chat logs are the most reliable and do not need corroboration.
   • DThe smartphone is the only source that requires special handling.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the first step in establishing forensic readiness within an organization?

   • ATraining all employees on forensic procedures.
   • BIdentifying the potential sources of digital evidence and the types of incidents the organization may face.
   • CPurchasing forensic software and hardware.
   • DCreating a chain of custody form template.
   Reveal Solution Discussion Select an answer first