Computer Forensics Fundamentals ECSS Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company experiences a ransomware attack. The incident response team contains the threat and restores systems from backups. Later, the legal department wants to know how the attacker gained access. Which activity would BEST support this investigation?

   • AData breach notification to regulators
   • BComputer forensics on the affected systems
   • CRestoring more backups
   • DE-discovery of all company emails
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A forensic examiner is investigating a case where the suspect's computer has a solid-state drive (SSD). The examiner needs to recover deleted files. What is the MOST important consideration?

   • ASSDs store data in a different format
   • BSSDs cannot be imaged with a write-blocker
   • CSSDs use wear leveling, which may permanently erase deleted data
   • DSSDs are slower than HDDs, so imaging takes longer
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security analyst detects suspicious network traffic and suspects a breach. The analyst isolates the affected system and begins collecting logs and memory dumps. This activity is BEST classified as:

   • AData recovery
   • BComputer forensics
   • CE-discovery
   • DIncident response
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A forensic investigator is analyzing a hard drive that was seized from a suspect. The investigator finds a file that appears to be a deleted document. The file's metadata shows a creation date that is after the suspect's arrest. What should the investigator conclude?

   • AThe file is a false positive and should be ignored.
   • BThe file is not relevant to the case because it was created after the arrest.
   • CThe file is definitely evidence of the suspect's guilt.
   • DThe file may have been tampered with, and its authenticity is questionable.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is the primary difference between computer forensics and incident response?

   • AComputer forensics focuses on evidence preservation for legal proceedings, while incident response focuses on containing and eradicating a threat
   • BComputer forensics uses only hardware tools, while incident response uses only software tools
   • CComputer forensics is performed only by law enforcement, while incident response is performed only by private companies
   • DComputer forensics is reactive, while incident response is proactive
   Reveal Solution Discussion Select an answer first