Legal Compliance in Computer Forensics DFE Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which principle of data protection requires that personal data collected for forensic purposes be adequate, relevant, and limited to what is necessary in relation to the investigation?

   • AData encryption
   • BData sovereignty
   • CData minimization
   • DData retention
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic investigator in the EU is asked to analyze a suspect's email account stored on a server in the United States. The investigation is part of a criminal case. Which legal consideration is most directly relevant before the investigator accesses the data?

   • AWhether the email server uses encryption at rest.
   • BWhether the data transfer across borders complies with GDPR data transfer rules.
   • CWhether the investigator has a forensic certification.
   • DWhether the suspect has a strong password on the email account.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   An investigator is asked to examine a server that is shared by multiple departments. The investigation is about one employee's alleged wrongdoing. The server contains sensitive HR data for many other employees. The company wants to minimize disruption and legal risk. What is the best approach?

   • AShut down the server and seize it entirely.
   • BAsk the employee to provide their own files.
   • CPerform a forensic image of the entire server and then filter the analysis to the relevant employee's data.
   • DOnly copy the specific files related to the employee to avoid touching other data.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A forensic team is investigating a data breach that may involve personally identifiable information (PII) of customers. The breach occurred in a jurisdiction that has a mandatory breach notification law. The team has completed the initial forensic analysis and identified the scope of the breach. According to compliance requirements, what should the team do next?

   • APublish a public statement about the breach to maintain transparency, without notifying regulators.
   • BWait until the investigation is fully complete and all evidence is documented before notifying anyone.
   • CNotify only the company's legal counsel and insurance provider, as they are the primary stakeholders.
   • DNotify the appropriate regulatory authority and affected individuals within the legally prescribed timeframe.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An investigator is asked to examine a company-owned laptop for evidence of employee misconduct. The employee has a personal folder on the laptop. The company's policy states that employees have no expectation of privacy on company devices. What should the investigator do first?

   • AImmediately image the entire hard drive to preserve evidence.
   • BSkip the personal folder to avoid privacy issues.
   • CAsk the employee for consent to search the laptop.
   • DObtain written authorization from the company's legal counsel or management.
   Reveal Solution Discussion Select an answer first