Roles and Responsibilities of a Forensic Investigator DFE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   What is the primary role of a digital forensic investigator?

   • ATo prosecute cybercriminals in a court of law
   • BTo recover deleted files from any storage device regardless of the situation
   • CTo identify, preserve, analyze, and present digital evidence in a manner that is legally acceptable
   • DTo secure an organization's network against cyberattacks
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   During a forensic examination, an investigator discovers personal emails unrelated to the case but that could embarrass the company's CEO. The investigator's supervisor suggests deleting these emails to avoid negative publicity. What should the investigator do?

   • ADocument the emails and report them to the legal team, explaining the ethical conflict.
   • BIgnore the emails and continue the investigation without mentioning them.
   • CDelete the emails as instructed to protect the company's reputation.
   • DCopy the emails to a personal drive to preserve them for later use.
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A forensic investigator is part of a corporate incident response team. The team is responding to a phishing attack that resulted in unauthorized access to employee credentials. The investigator's role is to determine how the attack occurred and what data was accessed. Which task is the investigator responsible for?

   • AResetting all employee passwords to prevent further access.
   • BAnalyzing email headers and logs to trace the attack vector.
   • CPatching the vulnerability that allowed the phishing email to reach employees.
   • DNotifying affected customers about the data breach.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A forensic investigator is called to a scene where a server has been seized by law enforcement. The investigator is asked to perform a forensic acquisition. However, the server is running a critical application that cannot be shut down without significant business impact. The investigator has limited time and must decide between a live acquisition and a dead acquisition. Which factor should most heavily influence the decision?

   • AThe preference of the organization's management to avoid downtime.
   • BThe cost of the forensic tools required for each method.
   • CThe desire to minimize the time spent on the acquisition.
   • DThe need to preserve volatile data that would be lost in a dead acquisition.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A forensic investigator is hired by a defense attorney to review the prosecution's digital evidence in a criminal case. The investigator finds that the prosecution's forensic image was created without a write blocker. What is the most appropriate action for the investigator to take?

   • AImmediately inform the court that the evidence is inadmissible.
   • BRe-image the original evidence using a write blocker to correct the error.
   • CIgnore the issue because the prosecution's tools are generally reliable.
   • DDocument the lack of a write blocker and assess whether the evidence integrity was compromised.
   Reveal Solution Discussion Select an answer first