Introduction to Computer Forensics DFE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best defines computer forensics?

   • AThe practice of securing computer systems to prevent unauthorized access
   • BThe use of specialized hardware to recover deleted files from storage media
   • CThe process of collecting, preserving, analyzing, and presenting digital evidence in a manner that is legally acceptable
   • DThe process of monitoring network traffic to detect intrusions in real time
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A small business owner suspects an employee of leaking customer data. The owner wants to know if the employee's work computer contains evidence of the leak. The owner asks an IT contractor to 'take a look' at the computer. Which approach best reflects the purpose of computer forensics in this situation?

   • AInstall monitoring software on the computer to observe future activity
   • BAsk the employee to explain any suspicious files found on the computer
   • CUse forensic tools to create an image of the hard drive and analyze the image
   • DHave the contractor browse the computer's files and report anything suspicious
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic analyst is investigating a case of intellectual property theft. The analyst has acquired a forensic image of the suspect's computer and is now examining the image to find deleted files and reconstruct user activity. Which goal of computer forensics is the analyst primarily performing?

   • AExtraction
   • BIdentification
   • CInterpretation
   • DPreservation
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A forensic investigator is called to a crime scene where a suspect's laptop is running and displaying an open email client. The investigator must ensure the integrity of the data for later analysis. Which immediate action best aligns with the computer forensics process?

   • APhotograph the screen, then perform a controlled shutdown
   • BCopy the email client's data to a USB drive before shutting down
   • CPull the power cord immediately to stop all processes
   • DClose the email client and then shut down the system
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A forensic investigator is called to assist in a case where a company's server was hacked, and customer data was stolen. The company wants to know how the attacker gained access, and law enforcement wants to prosecute the attacker. The investigator must balance the company's need for a detailed technical report with the legal requirement for admissible evidence. What is the investigator's primary responsibility?

   • ATo identify the attacker and recommend security improvements
   • BTo provide a detailed technical report to the company
   • CTo ensure the evidence is collected and preserved in a forensically sound manner
   • DTo cooperate with law enforcement and share all findings
   Reveal Solution Discussion Select an answer first