Digital Forensics Concepts and Application GCED Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is steganography?

   • AThe use of a VPN to hide network traffic.
   • BThe process of encrypting data to make it unreadable.
   • CThe deletion of files to prevent recovery.
   • DThe practice of hiding data within other data, such as embedding a message in an image file.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An incident responder needs to create a forensic image of a USB drive that may contain evidence. The responder has a write-blocker and forensic imaging software. Which step is essential to ensure the image is a valid bit-for-bit copy?

   • ACopy only the files that appear relevant to the investigation.
   • BFormat the USB drive before imaging to remove any existing data.
   • CUse the operating system's copy command to duplicate the drive contents.
   • DVerify the hash of the original drive and the image match after acquisition.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An examiner is analyzing a forensic image and finds that the suspect used full-disk encryption. The examiner has the suspect's password, but the encryption software also supports a recovery key. Which approach is MOST likely to successfully decrypt the drive while preserving the integrity of the evidence?

   • AUse the recovery key to decrypt the drive in a forensic environment, then create a bit-for-bit image of the decrypted data.
   • BAnalyze the encrypted image directly without decryption, looking for file signatures.
   • CBoot the original drive on the suspect's computer and use the password to log in, then copy the files.
   • DAttempt to brute-force the encryption key using a GPU cluster.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which statement best defines digital forensics in the context of incident response?

   • AThe process of collecting and analyzing digital evidence to support legal proceedings or internal investigations.
   • BThe real-time monitoring of network traffic to detect and block malicious activity.
   • CThe use of specialized hardware to recover data from damaged storage devices.
   • DThe practice of encrypting all data on a network to prevent unauthorized access.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A forensic examiner is collecting evidence from multiple computers at a crime scene. To ensure the evidence is admissible, which practice is MOST important during the collection phase?

   • ACopy the files from each computer to a single external drive.
   • BTurn on each computer to check if it is functioning.
   • CLabel each piece of evidence with a unique identifier and record its location and time of collection.
   • DInterview the suspect before collecting evidence.
   Reveal Solution Discussion Select an answer first