Roles and Responsibilities of a Forensic Investigator DFE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A small company has experienced a data breach. The CEO wants to quickly identify the source of the breach and asks the forensic investigator to 'just look at the logs and tell us what happened.' The investigator knows that a proper forensic process is required. Which response best reflects the investigator's role?

   • AAsk the IT team to copy the logs to a USB drive for immediate analysis.
   • BExplain that a systematic process of evidence collection and analysis is necessary to ensure reliable findings.
   • CAgree to quickly review the logs and provide an informal opinion.
   • DRefuse to assist unless law enforcement is involved.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A forensic investigator is asked to examine a computer that belongs to a company that is being sued. The plaintiff's attorney wants the investigator to provide a report that can be used in civil litigation. The investigator must ensure that the report is objective and unbiased. Which practice is most important?

   • AFocus only on evidence that supports the company's defense.
   • BUse the plaintiff's attorney's preferred tools to ensure consistency.
   • CInclude personal opinions about the credibility of witnesses.
   • DDocument all findings, including those that do not support the company's position.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard · select all that apply

   A forensic investigator is examining a compromised server. The investigator has identified a malicious script that appears to be the cause of the breach. Select all actions that the investigator should take to fulfill their responsibilities.

   • APreserve the malicious script as evidence and document its location and metadata.
   • BReboot the server to ensure the script is no longer active.
   • CRun the script in a sandbox to observe its behavior.
   • DShare the script with the organization's threat intelligence team for further analysis.
   • EDelete the script immediately to prevent further damage.
   Check answers Discussion Select an answer first
5. 4application · medium

   A forensic investigator is assigned to a case involving a suspected insider threat. The investigator has collected a forensic image of the suspect's workstation. The legal team asks for a report that can be used in disciplinary proceedings. Which component is essential to include in the report?

   • AA recommendation for the employee's termination
   • BA detailed description of the evidence and the analysis methods used
   • CThe investigator's personal opinion about the employee's guilt
   • DA summary of the employee's performance reviews
   Reveal Solution Discussion Select an answer first
6. 5expert · hard · select all that apply

   A forensic investigator is responding to a suspected insider threat. The investigator has identified a laptop that may contain relevant evidence. The laptop is currently in use by the employee, who is unaware of the investigation. Select all actions that align with the investigator's responsibilities.

   • ANotify the employee's manager to ensure the employee is monitored.
   • BSeize the laptop immediately without notifying the employee.
   • CCreate a forensic image of the laptop's hard drive before any analysis.
   • DInterview the employee immediately to gather their account of events.
   • EDocument the current state of the laptop, including running processes and network connections.
   Check answers Discussion Select an answer first