Digital Forensics Concepts and Application GCED Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An investigator is analyzing a forensic image of a Windows 10 system and needs to determine when a specific document was last accessed. Which artifact should the investigator examine?

   • AThe Windows Event Log for file access auditing.
   • BThe NTFS $MFT file metadata for the document.
   • CThe Recycle Bin contents.
   • DThe Windows Prefetch files.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What type of information is typically found in file metadata?

   • AThe content of the file.
   • BThe file's creation, modification, and access timestamps.
   • CThe network packets sent by the system.
   • DThe user's password.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A forensic investigator is collecting evidence from a server that is part of a critical production environment. The server cannot be shut down, but the investigator needs to preserve the disk for analysis. The investigator has a forensic write-blocker and a hot-swappable disk bay. Which approach best balances evidence integrity with operational continuity?

   • ARemove the disk from the hot-swap bay without write-blocking and image it on another machine.
   • BSchedule a maintenance window to shut down the server and perform a static acquisition with a write-blocker.
   • CCopy the entire disk to a network share using the server's built-in backup software.
   • DPerform a live acquisition of the disk using a forensic tool that supports hot-swapping, then verify the image hash.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is responding to a ransomware incident on a Windows server. The team needs to determine the attacker's entry point and the extent of the compromise. The server is still running, but the team is concerned that the attacker may have anti-forensic tools running. Which action should the team take first?

   • ACreate a forensic image of the hard drive first.
   • BDisconnect the server from the network to prevent further data exfiltration.
   • CRun a full antivirus scan to identify malware on the system.
   • DAcquire a memory dump before any other action to capture running processes and network connections.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst suspects that an internal host is communicating with a known command-and-control server. The analyst needs to capture network traffic to confirm the communication and preserve it as evidence. Which approach is most appropriate?

   • AUse an inline intrusion prevention system to block the communication and log the alerts.
   • BInstall packet capture software directly on the suspect host.
   • CConfigure a SPAN port on the switch to send traffic to a forensic capture system running tcpdump.
   • DQuery the firewall logs for connection records to the C2 server.
   Reveal Solution Discussion Select an answer first