Computer Forensics Fundamentals ECSS Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company's legal team requests that all emails and documents related to a pending lawsuit be collected and preserved. The IT team is asked to search file servers and email archives for relevant data. This activity is BEST described as:

   • AE-discovery
   • BData breach notification
   • CIncident response
   • DComputer forensics
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A forensic investigator is handling a case involving a company server that was allegedly used to distribute illegal content. The server is located in a jurisdiction with strict privacy laws. The investigator has a warrant to seize the server, but the warrant does not explicitly authorize the seizure of the server's backup tapes, which are stored offsite. The investigator believes the backup tapes contain crucial evidence. What should the investigator do?

   • ASeize the backup tapes because they are part of the same server system.
   • BSeek a new warrant that explicitly covers the backup tapes.
   • CAsk the company's IT staff to provide the backup tapes voluntarily.
   • DCopy the backup tapes without seizing them, leaving the originals in place.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   During a forensic investigation, an examiner finds a deleted file that contains relevant evidence. The examiner recovers the file and notes its original location, timestamps, and the fact that it was deleted. Why is documenting these details important?

   • ATo demonstrate the file's authenticity and integrity
   • BTo determine the file's original content
   • CTo establish the chain of custody
   • DTo prove the file was deleted intentionally
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In which phase of a computer forensic investigation does the examiner draw conclusions and prepare a report for the court?

   • AAnalysis
   • BPresentation
   • CIdentification
   • DPreservation
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company is investigating an insider threat. The security team has identified that an employee has been accessing sensitive files outside of normal working hours. The team needs to determine whether the employee's actions constitute a policy violation or a criminal act. Which discipline should be used to make this determination?

   • AComputer forensics
   • BIncident response
   • CA combination of computer forensics and legal review
   • DE-discovery
   Reveal Solution Discussion Select an answer first