Roles and Responsibilities of a Forensic Investigator DFE Practice Questions (Page 9)

Questions 41–45

1. 41application · medium

   A forensic investigator is examining a mobile device that belongs to a former employee. The device contains both personal and corporate data. The investigator needs to extract evidence related to a non-compete agreement violation. What is the most appropriate ethical approach?

   • ALimit the search to data relevant to the alleged violation and document the scope.
   • BIgnore the personal data and only analyze corporate emails.
   • CExtract all data from the device to ensure nothing is missed.
   • DAsk the former employee for permission to search the device.
   Reveal Solution Discussion Select an answer first
2. 42expert · hard

   A forensic investigator is asked to analyze a smartphone that belongs to a victim of cyberstalking. The victim has provided the phone and consented to the examination. The investigator discovers that the phone contains evidence of the stalking, but also finds unrelated personal data. The victim asks the investigator to delete the unrelated personal data. What should the investigator do?

   • ACopy the unrelated data to a separate location and then delete it from the phone.
   • BRefuse to analyze the phone further until the victim agrees to keep all data.
   • CExplain that the evidence must be preserved and that deletion could compromise the investigation.
   • DDelete the unrelated personal data to respect the victim's privacy.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which action is an ethical obligation of a forensic investigator?

   • AWithholding evidence that could harm the organization
   • BSharing case details with colleagues for professional discussion
   • CReporting findings objectively without bias or exaggeration
   • DUsing any means necessary to extract data from a device
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A forensic investigator is working on a case involving a network intrusion. The organization's IT team wants to immediately patch the vulnerability that was exploited. The legal team wants to preserve evidence for potential prosecution. How should the investigator advise the organization?

   • AAllow IT to patch immediately and then collect evidence from backups.
   • BTell the legal team that patching will not affect the evidence.
   • CAdvise IT to wait until the investigation is complete before patching.
   • DCoordinate with IT to capture forensic evidence before the patch is applied.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard · select all that apply

   A forensic investigator is asked to examine a computer that belongs to a third-party contractor. The contractor is not an employee of the organization, and the organization does not have a signed agreement allowing forensic examination. Select all actions that the investigator should take to ensure legal and ethical compliance.

   • ASeize the device and examine it without consent to avoid losing evidence.
   • BProceed with the examination because the computer is used for work purposes.
   • CAsk the contractor for written consent to examine the device.
   • DIgnore the device because it is not owned by the organization.
   • EObtain legal advice to determine if a warrant or subpoena is required.
   Check answers Discussion Select an answer first