Roles and Responsibilities of a Forensic Investigator DFE Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A forensic investigator is examining a compromised database server. The organization wants to know the extent of the data exfiltration. The investigator has access to the server logs, but the logs are incomplete due to log rotation. What is the best approach to determine the extent of the breach?

   • AAsk the IT team to restore the logs from backup.
   • BRely solely on the server logs and note the gaps in the report.
   • CCorrelate the available logs with network traffic captures and other system logs.
   • DInterview the database administrator to recall what happened.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A forensic investigator is part of a team responding to a ransomware incident. The incident response team wants to restore systems from backups as quickly as possible. The investigator needs to preserve evidence for a potential criminal investigation. What should the investigator do?

   • ALet the team restore systems and then analyze the backups.
   • BAsk the team to make a copy of the encrypted files for analysis.
   • CCoordinate with the team to capture forensic images of affected systems before restoration.
   • DInsist that systems remain offline until the investigation is complete.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic investigator is called to examine a laptop that may contain evidence of intellectual property theft. The investigator is told that the laptop's user is a senior executive and that the legal team wants to avoid disrupting business operations. The investigator needs to begin the process while preserving evidence and maintaining the chain of custody. Which action should the investigator take first?

   • ACreate a forensic image of the laptop's storage media using a write blocker.
   • BCopy the relevant files to a USB drive for quick analysis.
   • CInterview the executive to gather context about the alleged theft.
   • DNotify law enforcement immediately to take custody of the laptop.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard · select all that apply

   A forensic investigator is part of a team responding to a security incident that may involve criminal activity. The team includes IT staff, legal counsel, and law enforcement. Select all actions that reflect the investigator's proper role in this collaboration.

   • AShare preliminary findings with law enforcement only after coordinating with legal counsel.
   • BAdvise IT staff on how to preserve evidence while containing the threat.
   • CMake the final decision on whether to involve law enforcement.
   • DProvide the legal team with a clear explanation of the technical evidence and its limitations.
   • ELead the incident response effort and direct IT staff on how to contain the threat.
   Check answers Discussion Select an answer first
6. 10application · medium

   A forensic investigator is working with law enforcement on a case involving child exploitation. The investigator has identified a suspect's computer that may contain illegal images. The investigator is not a law enforcement officer. What is the investigator's primary role in this collaboration?

   • AObtain a search warrant for the suspect's computer.
   • BDecide whether the case should be prosecuted.
   • CProvide technical expertise in collecting and analyzing digital evidence.
   • DArrest the suspect if evidence is found.
   Reveal Solution Discussion Select an answer first