Data on the Network GBFA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A forensic examiner is asked to capture network traffic from a corporate network that includes traffic from a third-party contractor's devices. The contract with the contractor does not include a monitoring clause. What should the examiner do?

   • ACapture contractor traffic but redact any personal information.
   • BExclude the contractor's devices from the capture to avoid violating the contract.
   • CCapture all traffic including contractor devices to ensure complete evidence.
   • DAsk the contractor for verbal consent to capture.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A forensic examiner is asked to capture network traffic from a corporate network that spans multiple jurisdictions. The company has offices in the EU and the US. The capture will include traffic from both offices. The examiner needs to ensure compliance with GDPR and other applicable laws. What is the most important consideration?

   • AAnonymize all IP addresses in the capture to protect privacy.
   • BCapture all traffic to ensure no evidence is missed, regardless of jurisdiction.
   • CEnsure that the capture is limited to traffic relevant to the investigation and that data is processed in accordance with GDPR requirements for cross-border transfers.
   • DStore the capture on a server located in the US to avoid GDPR obligations.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   You are a forensic analyst who has captured network evidence from a corporate network. The evidence is stored on a network share that is accessible to other analysts. You need to ensure the evidence is not altered and that the chain of custody is maintained. Which combination of actions is most effective?

   • ACopy the evidence to a USB drive and keep it in a desk drawer.
   • BRename the evidence file to a non-descriptive name to prevent casual access.
   • CCreate a cryptographic hash of the evidence and store the hash in a secure location, and restrict access to the evidence to authorized personnel only.
   • DCompress the evidence and store it on the same network share.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A forensic investigator is asked to capture network traffic from a corporate network that spans multiple jurisdictions. The company has offices in two countries with different data privacy laws. The investigation involves a suspected data breach. The investigator has a warrant for the office in Country A but not for the office in Country B. What is the most appropriate course of action?

   • ACapture traffic only from the office in Country A where the warrant is valid, and coordinate with local authorities in Country B for any necessary capture.
   • BCapture traffic from both offices and later redact any personal data.
   • CCapture traffic from both offices because the investigation is for a data breach.
   • DAsk the company's legal team for permission to capture in both offices.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A forensic examiner is asked to capture network traffic from a corporate network to investigate a potential data breach. The company's legal counsel has provided written authorization. The capture will include traffic from employee workstations. What is the most important legal consideration before starting the capture?

   • AEnsure the capture is limited to traffic relevant to the investigation and that employees have been notified of monitoring policies.
   • BCapture all traffic to avoid missing evidence, even if it includes personal communications.
   • CUse encryption on the capture file to protect it from unauthorized access.
   • DStore the capture on a personal device to keep it separate from corporate systems.
   Reveal Solution Discussion Select an answer first