A forensic examiner is preparing to acquire evidence from a computer that is part of a corporate network. The examiner must ensure that the evidence is not altered during acquisition. Which method is most appropriate?

Boot the computer normally and copy the files to an external drive

Use a write-blocker and create a bit-for-bit image of the hard drive

Use the computer's built-in backup software to create a backup

Remove the hard drive and connect it to another computer to copy the files

In a legal context, what is the role of computer forensics?

To determine the guilt or innocence of a defendant

To prosecute cybercriminals automatically

To replace the need for human witnesses

To provide digital evidence that is admissible in court

How does computer forensics support organizational incident response?

By deleting malicious files from affected systems

By preventing all future cyberattacks

By identifying the root cause and extent of a security incident

By automatically patching vulnerabilities in the network

A company's incident response team is handling a ransomware attack. The team wants to preserve evidence for law enforcement, but also wants to restore operations quickly. Which approach best balances these competing needs?

Wait for law enforcement to arrive before taking any action

Isolate affected systems, create forensic images, and then begin restoration on separate systems

Immediately reimage all affected systems to restore operations

Pay the ransom to get the decryption key and then restore systems

EC-CouncilDigital Forensics Essentials

Domain 1Objective 1

Introduction to Computer Forensics DFE Practice Questions (Page 3)

Part of the Computer Forensics Foundations and Process domain, which makes up ~15% of our current practice bank.

35questions here

7free pages

5concepts

Questions 11–15

11expert · hard
A forensic examiner is preparing to acquire evidence from a computer that is part of a corporate network. The examiner must ensure that the evidence is not altered during acquisition. Which method is most appropriate?
Select an answer first
12foundation · easy
In a legal context, what is the role of computer forensics?
Select an answer first
13application · medium
A forensic analyst is investigating a case of unauthorized access to a company's database. The analyst has collected logs from the database server and is now correlating them with the suspect's workstation activity. Which step of the computer forensics process is the analyst performing?
Select an answer first
14foundation · easy
How does computer forensics support organizational incident response?
Select an answer first
15expert · hard
A company's incident response team is handling a ransomware attack. The team wants to preserve evidence for law enforcement, but also wants to restore operations quickly. Which approach best balances these competing needs?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DFE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “DFE” is a trademark of its owner, used for identification only.