Digital Evidence and Forensic Readiness DFE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo document every person who handled the evidence and every transfer of custody.
   • BTo encrypt the evidence so that only authorized personnel can access it.
   • CTo create a backup copy of the evidence for analysis.
   • DTo ensure the evidence is stored in a secure, climate-controlled environment.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   An investigator must collect evidence from a server that is still in production and cannot be taken offline. The server hosts a critical application. Which approach best preserves evidence while minimizing disruption?

   • ACopy only the application's log files to an external drive.
   • BReplace the hard drives with new ones and keep the old drives as evidence.
   • CShut down the server and create a forensic image of the hard drives.
   • DPerform a live forensic acquisition of the server's memory and relevant logs.
   Reveal Solution Discussion Select an answer first
4. 43expert · hard

   A multinational company is designing a forensic readiness program. The legal team requires that all employee communications be logged for potential litigation, but the privacy team warns that this may violate data protection regulations in some countries. The IT team is concerned about the storage cost of logging all communications. Which approach best satisfies all three constraints?

   • ALog all communications but store them only in the country with the most permissive data protection laws
   • BLog all communications and store them indefinitely in a low-cost archive
   • CDo not log any communications to avoid privacy violations
   • DLog only metadata (sender, recipient, timestamp) and retain it for a period that complies with the most restrictive jurisdiction's laws
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A forensic team is collecting evidence from a small office network after a suspected data breach. Which source is LEAST likely to contain relevant digital evidence?

   • AThe firewall's connection logs
   • BThe network switch's MAC address table
   • CThe office coffee machine's firmware
   • DThe receptionist's desktop computer
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A forensic investigator is asked to collect evidence from a company-owned laptop that is also used for personal activities by the employee. The employee is suspected of fraud. The company's policy states that all data on company devices is company property. Which action is most legally defensible?

   • ACollect all data from the laptop, including personal files, because the policy allows it
   • BSeize the laptop and image the entire drive, then sort through the data later
   • CCollect only files related to the fraud investigation and avoid personal files
   • DAsk the employee for consent to collect all data
   Reveal Solution Discussion Select an answer first