Legal Compliance in Computer Forensics DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A multinational company is investigating a data breach that may involve servers located in three different countries. The legal team asks the forensic investigator which laws might govern the collection of evidence. What is the most appropriate response?

   • AThe laws of each country where the servers are located may apply, along with international agreements.
   • BNo laws apply because it is a private investigation.
   • COnly the laws of the country where the company is headquartered apply.
   • DThe company's internal policies override local laws.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which ethical obligation requires a forensic investigator to avoid any action that could alter or destroy digital evidence?

   • AReporting findings to law enforcement
   • BEnsuring confidentiality of the investigation
   • CPreserving the integrity of evidence
   • DMaintaining objectivity and impartiality
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of maintaining a chain of custody for digital evidence?

   • ATo ensure that the evidence is stored in a secure location
   • BTo provide a backup copy of the evidence
   • CTo document every person who handled the evidence and every transfer of custody
   • DTo encrypt the evidence to prevent unauthorized access
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A forensic investigator is called to image a laptop involved in an internal fraud investigation. The company's legal counsel has provided written authorization, but the investigator notices the laptop's clock is set to the wrong timezone. The investigator proceeds with the acquisition. Later, the defense attorney challenges the evidence's authenticity. Which action would most directly strengthen the admissibility of the acquired image?

   • ADiscard the image and rely only on the written authorization as proof of the investigation's validity.
   • BReimage the laptop after correcting the timezone to ensure all timestamps are accurate.
   • CUse a write blocker and reacquire the image, then compare hashes to the first image.
   • DDocument the system clock offset and timezone in the acquisition notes and include it in the final report.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A multinational company's HR department suspects an employee of leaking confidential data. The company's legal team wants to collect evidence from the employee's company-issued laptop, which is located in a country with strict data protection laws. The employee is a citizen of another country. Which factor is most important for the legal team to consider before proceeding?

   • AThe data protection laws of the country where the laptop is located, as they govern the collection and handling of personal data.
   • BThe employee's consent, because without it, no data can be collected under any circumstances.
   • CThe company's headquarters location, because the company's internal policies are governed by its home country's laws.
   • DThe employee's citizenship, because it determines which country's privacy laws apply to the employee's personal data.
   Reveal Solution Discussion Select an answer first