Digital Evidence and Forensic Readiness DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An investigator collects a laptop from a suspect's desk. The laptop is powered on and shows an open email client. To preserve evidence, which action should the investigator take first?

   • AImmediately pull the power cord and remove the battery.
   • BPhotograph the screen and then shut down the laptop normally.
   • CClose the email client and then create a forensic image.
   • DDocument the screen contents and then perform a live acquisition of RAM.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a common source of digital evidence?

   • AA router's logs of network traffic.
   • BA suspect's fingerprint on a keyboard.
   • CA witness's verbal testimony about what they saw on a screen.
   • DA printed copy of an email.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During an investigation, an examiner discovers that the evidence includes private emails between employees. The examiner is not authorized to view personal communications. What should the examiner do?

   • AStop the examination and seek legal guidance on how to handle the data.
   • BDelete the emails to avoid privacy issues.
   • CContinue the investigation and ignore the privacy concern.
   • DRead the emails to determine if they are relevant.
   Reveal Solution Discussion Select an answer first
5. 34application · easy

   An investigator is collecting evidence from a corporate network. Which source is most likely to contain evidence of an employee's web browsing activity?

   • AThe firewall's intrusion prevention logs
   • BThe employee's workstation browser history
   • CThe network's DNS server logs
   • DThe company's email server logs
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   An investigator is collecting evidence from a network after a data exfiltration incident. The network has a firewall, an intrusion detection system (IDS), and a proxy server. The investigator needs to determine what data was exfiltrated. Which source is most likely to contain the actual data that was sent?

   • AThe proxy server's cache and logs
   • BThe router's routing table
   • CThe firewall's connection logs
   • DThe IDS's alert logs
   Reveal Solution Discussion Select an answer first