Digital Forensics Concepts and Application GCED Practice Questions (Page 10)

Questions 46–49

1. 46foundation · easy

   Why is memory forensics important in incident response?

   • AIt captures volatile data such as running processes, network connections, and open files that are lost when the system is powered off.
   • BIt provides a permanent record of all files stored on the hard drive.
   • CIt identifies the physical location of the attacker.
   • DIt can recover deleted files from unallocated space on the disk.
   Reveal Solution Discussion Select an answer first
2. 47foundation · easy

   What is a key characteristic of a legally defensible forensic report?

   • AIt omits any negative findings that could weaken the case.
   • BIt uses technical jargon to demonstrate expertise.
   • CIt includes only the investigator's conclusions without supporting data.
   • DIt is written in a clear, objective manner and includes all relevant findings and methodologies.
   Reveal Solution Discussion Select an answer first
4. 48foundation · easy

   Which tool is commonly used to capture network traffic for forensic analysis?

   • ANmap
   • BWireshark
   • CMetasploit
   • DJohn the Ripper
   Reveal Solution Discussion Select an answer first
5. 49foundation · easy

   What is the key difference between live acquisition and static acquisition?

   • ALive acquisition requires specialized hardware, while static acquisition does not.
   • BLive acquisition is performed on a running system, while static acquisition is performed on a powered-off system.
   • CStatic acquisition is used only for network devices.
   • DLive acquisition is faster than static acquisition.
   Reveal Solution Discussion Select an answer first