Forensic Investigation Process (pre-, Investigation, and Post-Investigation Phases) DFE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A small business owner suspects an employee of stealing customer data. The owner wants to investigate the employee's work laptop. The laptop is company-owned, but the employee has a personal password on it. What is the most appropriate action for the owner?

   • ACheck the company's acceptable use policy and employment agreement for consent to search
   • BAsk the employee for the password and then search the laptop
   • CSeize the laptop and have a forensic expert bypass the password
   • DImmediately call law enforcement to seize the laptop
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A forensic examiner has completed the analysis of a hard drive in a workplace misconduct case. The findings will be presented to HR for an internal disciplinary decision. What is the most important element of the final report in this context?

   • AA detailed explanation of every forensic tool used during the analysis
   • BA clear, non-technical summary of findings and how they relate to the allegations
   • CA list of all files deleted from the hard drive
   • DThe raw hash values of all imaged drives
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is investigating a suspected insider threat. The suspect's computer is in a remote office, and the company has a policy that allows monitoring of company devices. However, the suspect is in a country with strict privacy laws. What is the most important consideration before seizing the device?

   • AThe company should immediately seize the device to prevent evidence loss
   • BThe company should consult with local legal counsel to ensure compliance with privacy laws
   • CThe company's internal policy is sufficient to authorize the seizure
   • DThe company should ask the employee for consent to search the device
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In the pre-investigation phase of a digital forensic investigation, which action is considered a preparatory step that must occur before any evidence is collected?

   • ACreating a forensic image of all storage devices
   • BObtaining formal authorization to conduct the investigation
   • CWriting the final forensic report
   • DInterviewing witnesses to establish a timeline
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic team is called to a crime scene where a computer is found turned on and displaying an open email account. The team needs to preserve potential evidence. What should they do FIRST to preserve volatile data?

   • ACopy the open email to a USB drive for later analysis.
   • BPhotograph the screen and then immediately capture the RAM contents.
   • CUnplug the computer from the power source to prevent remote access.
   • DShut down the computer using the operating system's shutdown command.
   Reveal Solution Discussion Select an answer first