Computer Forensics Fundamentals ECSS Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has just experienced a data breach. The security team has identified the source of the breach and has contained it. The legal department now needs to determine the extent of the data loss and prepare a report for regulatory authorities. Which discipline should the legal department engage to produce the report?

   • AIncident response
   • BA combination of incident response and computer forensics
   • CE-discovery
   • DComputer forensics
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A forensic examiner is documenting evidence from a crime scene. The examiner photographs the computer screen, notes the serial number, and records the time and date. Which characteristic of digital evidence is being addressed?

   • AAuthenticity
   • BRedundancy
   • CVolatility
   • DLiability
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A forensic investigator is examining a company-owned laptop that was used by an employee who is suspected of fraud. The employee has a personal email account open on the laptop. Which action is most appropriate regarding the personal email data?

   • ADocument the existence of the personal email and consult with legal counsel before accessing it.
   • BDelete the personal email data to protect the employee's privacy.
   • CIgnore the personal email data because it is outside the scope of the investigation.
   • DAccess the personal email immediately to look for evidence of fraud.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which statement best defines computer forensics?

   • AThe real-time monitoring of network traffic to detect and block intrusions
   • BThe process of encrypting data to protect it from unauthorized access during transmission
   • CThe use of specialized hardware to recover deleted files from damaged storage media
   • DThe process of identifying, preserving, analyzing, and presenting digital evidence in a legally acceptable manner
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A forensic examiner is called to a scene where a computer is still running. The suspect is known to be actively deleting files. The examiner must decide whether to capture RAM first or create a disk image first. What is the BEST course of action?

   • ADisconnect the network cable and then capture RAM
   • BPower down the system immediately to prevent further deletion
   • CCapture RAM first, then create a disk image
   • DCreate a disk image first, then capture RAM
   Reveal Solution Discussion Select an answer first