Digital Evidence and Forensic Readiness DFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A financial services company wants to improve its ability to respond to insider-threat incidents. The legal team has approved a policy that requires logging of all employee file-access activity, but the operations team is concerned about the storage cost of keeping logs for the required retention period. Which approach best balances forensic readiness with operational constraints?

   • ALog only failed access attempts and retain them for 30 days
   • BImplement centralized logging with a defined retention policy based on risk and legal requirements, and archive logs to cost-effective storage
   • CEnable verbose logging on all file servers and retain logs for the maximum period allowed by law
   • DStore logs only on the local disks of each file server to avoid network overhead
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A forensic investigator is collecting evidence from a cloud-hosted server. Which legal consideration is most important to address before collection?

   • AThe number of virtual machines running on the host
   • BThe color scheme of the cloud provider's dashboard
   • CThe physical location of the server and applicable jurisdiction
   • DThe brand of the cloud provider's hardware
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   An investigator is collecting evidence from a crime scene and finds a smartphone, a USB drive, and a router. Which item requires special handling to preserve volatile data?

   • AAll items require the same handling.
   • BRouter
   • CSmartphone
   • DUSB drive
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An investigator is documenting evidence from a computer and notices that the system clock is incorrect. Why is this significant?

   • AThe hard drive must be wiped and re-imaged.
   • BTimestamps on files may be inaccurate, affecting the timeline of events.
   • CThe investigator should set the clock to the correct time.
   • DThe computer cannot be used as evidence.
   Reveal Solution Discussion Select an answer first
6. 40application · easy

   A forensic examiner needs to document who accessed a seized hard drive and when. Which practice best supports the chain of custody?

   • AAllow only the lead investigator to handle the drive.
   • BKeep a detailed log of every person who handled the drive, with dates and purposes.
   • CMake a copy of the drive and discard the original.
   • DStore the drive in a locked cabinet with no access log.
   Reveal Solution Discussion Select an answer first