Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A system administrator discovers that a contractor's laptop was used to access the company's internal file share after the contractor's contract ended. The administrator wants to preserve evidence for a possible legal action. The laptop is still in the contractor's possession, and the company has a signed agreement allowing them to seize the device. What should the administrator do FIRST?

   • ACopy the entire hard drive to a network share for later analysis.
   • BPower on the laptop and browse the file share logs to confirm the unauthorized access.
   • CInterview the contractor to ask why they accessed the file share.
   • DSeize the laptop, place it in a secure evidence bag, and document the chain of custody.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is about to conduct an internal investigation into a suspected policy violation. The investigation will involve examining several employees' computers. The company's legal counsel has provided a written authorization that specifies the scope of the search. What is the investigator's PRIMARY responsibility during the pre-investigation phase?

   • AInform the employees that their computers will be examined.
   • BEnsure the authorization is current and covers all devices that will be examined.
   • CBegin collecting evidence immediately to avoid data loss.
   • DPurchase new forensic tools to ensure the latest technology is used.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which action is characteristic of the post-investigation phase in digital forensics?

   • APresenting evidence and findings in a legal context
   • BSecuring the crime scene
   • CIdentifying potential sources of evidence
   • DCreating a forensic image of the suspect's hard drive
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic analyst is investigating a case of intellectual property theft. The suspect's computer has been imaged, and the analyst needs to find evidence of the theft. The analyst suspects that the suspect used encryption to hide files. What should the analyst do to identify encrypted files?

   • ALook for files with the .enc extension.
   • BRun a keyword search for 'encrypted' in the file system.
   • CSearch for files with high entropy or known encryption file signatures.
   • DCheck the Windows registry for encryption software installation.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   After completing a forensic investigation, the investigator must present the evidence in a civil court case. The opposing counsel challenges the authenticity of the evidence, claiming the chain of custody was broken. What should the investigator have done during the investigation to prevent this challenge?

   • AMake multiple copies of the evidence and distribute them to the legal team.
   • BRely on the investigator's testimony that the evidence was not tampered with.
   • CDocument every person who handled the evidence and the time and purpose of each transfer.
   • DKeep the evidence in the investigator's personal locker without any logs.
   Reveal Solution Discussion Select an answer first