Computer Forensics Fundamentals ECSS Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A forensic investigator is examining a laptop that belongs to a company. The laptop contains both company data and personal files belonging to the employee. The investigation is related to a civil lawsuit. The employee's personal files may contain relevant evidence. What is the most appropriate course of action?

   • AExamine all files on the laptop, including personal files, because the laptop is company property.
   • BAsk the employee for permission to examine the personal files.
   • CSeek legal advice on the scope of the examination and obtain appropriate authorization if needed.
   • DExamine only the company data and ignore the personal files.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary role of computer forensics in an investigation?

   • ATo identify and patch software vulnerabilities in an organization's systems
   • BTo recover and analyze digital evidence while preserving its integrity for legal proceedings
   • CTo prevent cyberattacks by implementing security controls and firewalls
   • DTo monitor employee productivity and internet usage in real time
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A forensic examiner is analyzing a computer that belongs to a company. The examiner finds personal emails that are unrelated to the investigation. What is the ethical obligation of the examiner?

   • ADelete the emails to protect the individual's privacy
   • BInclude the emails in the report to show thoroughness
   • CShare the emails with law enforcement
   • DIgnore the emails and focus only on relevant evidence
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A forensic team is investigating a data breach. They have collected a forensic image of the affected server. The legal team wants to know if the breach exposed customer data. The forensic team must analyze the image to find evidence of data exfiltration. Which phase of the forensic process is this?

   • AIdentification
   • BPresentation
   • CAnalysis
   • DPreservation
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic examiner is about to analyze a laptop seized from a suspect. The suspect's attorney argues that the evidence was obtained illegally because the examiner did not have a warrant. Which concept is central to this argument?

   • ADigital evidence volatility
   • BData recovery techniques
   • CAdmissibility of evidence
   • DChain of custody
   Reveal Solution Discussion Select an answer first