Introduction to Computer Forensics DFE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of computer forensics?

   • ATo investigate digital evidence in a manner that supports legal or organizational proceedings
   • BTo recover lost or deleted data for business continuity
   • CTo optimize the performance of computer systems by analyzing logs
   • DTo prevent cyberattacks by identifying vulnerabilities in systems
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following lists the primary goals of computer forensics in the correct general order?

   • AIdentification, preservation, extraction, interpretation, documentation
   • BDocumentation, interpretation, preservation, identification, extraction
   • CPreservation, identification, extraction, documentation, interpretation
   • DExtraction, preservation, identification, documentation, interpretation
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic team is investigating a data breach at a financial institution. The team has identified a compromised server and must decide whether to take the server offline for a dead acquisition or perform a live acquisition. The server is critical to the institution's operations, and the breach is ongoing. What is the most important consideration in this decision?

   • AThe need to capture volatile data, such as running processes and network connections
   • BThe need to avoid disrupting the institution's customers
   • CThe need to preserve the server's operational status
   • DThe need to complete the acquisition as quickly as possible
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of digital evidence?

   • AA witness's verbal testimony
   • BA printed email message
   • CA file stored on a computer's hard drive
   • DA handwritten note found at a crime scene
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's security team detects a possible data breach. The incident response plan calls for preserving evidence for potential legal action. Which action is most consistent with the role of computer forensics in organizational incident response?

   • ANotify law enforcement before taking any action
   • BIsolate the affected systems and create forensic images before remediation
   • CDelete suspicious files to contain the breach quickly
   • DImmediately format the affected systems to prevent further spread of malware
   Reveal Solution Discussion Select an answer first