Password Protection and Encryption Techniques DFE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic team is developing a policy for handling encrypted devices during investigations. They want to ensure that they can access data when legally authorized while respecting privacy. Which policy is most appropriate?

   • AProhibit the use of encryption on company devices to avoid forensic challenges.
   • BStore all encryption keys on the same device as the encrypted data for convenience.
   • CAllow employees to use any encryption method without key recovery, trusting that forensic tools can bypass it.
   • DRequire employees to store recovery keys in a centralized escrow system accessible only to authorized forensic personnel.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A forensic examiner is investigating a laptop that uses file-level encryption (e.g., EFS) rather than full-disk encryption. The user's account has been deleted, but the examiner has a forensic image of the disk. Which challenge is most likely to arise?

   • AThe files are encrypted with a hardware token that is no longer available.
   • BThe entire disk image will be unreadable because the disk is encrypted.
   • CThe files can be decrypted by simply resetting the user's password.
   • DThe encrypted files may be inaccessible because the user's encryption certificate and private key are missing.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A forensic examiner is planning to image a computer that has full-disk encryption (FDE) enabled. The computer is currently powered off. What is the most important consideration for the examiner before creating the forensic image?

   • AUse a write-blocker to ensure the image is not altered
   • BPerform a live acquisition to avoid the encryption
   • CBoot the computer to create a memory dump before imaging
   • DObtain the encryption password or recovery key from the user or IT department
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A forensic examiner is trying to access a BitLocker-encrypted drive. The examiner has a memory dump from the system, but the dump was taken after the system was rebooted and the drive was locked. Which statement is most accurate?

   • AThe memory dump can be used to reconstruct the key from remnants.
   • BThe memory dump is unlikely to contain the BitLocker key because the drive is locked.
   • CThe memory dump can be used to brute-force the BitLocker password.
   • DThe memory dump will still contain the key because BitLocker keys persist in memory.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An examiner is investigating a computer that uses full-disk encryption (FDE). The computer is currently powered on and the user is logged in. The examiner needs to acquire the encrypted data without the user's password. Which technique is most likely to succeed?

   • AUse a hardware write-blocker and copy the raw disk sectors to an evidence drive.
   • BBoot from a forensic CD and use password recovery tools on the encrypted volume.
   • CPower off the system immediately and create a forensic image of the hard drive.
   • DPerform a live acquisition and capture the contents of RAM to extract the encryption keys.
   Reveal Solution Discussion Select an answer first