Roles and Responsibilities of a Forensic Investigator DFE Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A forensic investigator is part of a team responding to a ransomware incident. The team needs to preserve evidence while also restoring business operations quickly. Which action best balances these competing needs?

   • ADisconnect the systems and wait for law enforcement to arrive before any action.
   • BImmediately reimage all affected systems to restore operations as fast as possible.
   • CForensically image the affected systems before any restoration activities.
   • DAsk the IT team to reboot the systems to see if they recover automatically.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How does a forensic investigator typically interact with law enforcement during an investigation?

   • ABy conducting the interrogation of suspects
   • BBy making the final decision on whether to prosecute a suspect
   • CBy providing legal defense for the accused
   • DBy providing technical expertise and evidence to support the legal process
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A forensic investigator is examining a mobile device that is suspected of containing evidence of a crime. The device is password-protected, and the suspect refuses to provide the password. The investigator has a warrant that allows the search of the device. Which approach is most appropriate?

   • AUse forensic tools to bypass the password, ensuring that the device is not damaged.
   • BAsk the suspect's lawyer for the password.
   • CForce the device to reset to factory settings to remove the password.
   • DReturn the device to the suspect because the password cannot be obtained.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   During a corporate investigation, a forensic investigator discovers evidence that implicates a senior manager in fraudulent activity. The legal team requests that the investigator share preliminary findings with the company's board of directors. What should the investigator do?

   • APresent the full forensic report directly to the board to ensure transparency.
   • BRefuse to share any information until the investigation is complete.
   • CProvide a summary of findings to the legal team, who will then decide what to share with the board.
   • DShare the findings with the manager's supervisor to warn them of the issue.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which of the following is a key responsibility of a forensic investigator?

   • ADesigning the organization's firewall rules
   • BPerforming routine backups of corporate data
   • CConducting penetration tests to identify vulnerabilities
   • DCollecting evidence using forensically sound methods
   Reveal Solution Discussion Select an answer first