Digital Forensic Fundamentals GCFE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An examiner is investigating a case where a suspect allegedly sent a threatening email. The email was sent from a public Wi-Fi network. The examiner has the suspect's laptop. What is the most important evidence to preserve?

   • AThe suspect's IP address, as it can be used to identify the location of the sender.
   • BThe laptop's MAC address, as it can be used to identify the device on the network.
   • CThe Wi-Fi network's logs, as they can show which device was connected at the time.
   • DThe email itself, as it is the primary evidence of the threat.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which characteristic best defines digital evidence in a forensic context?

   • AIt is always admissible in court without any special handling.
   • BIt is only found on hard drives and solid-state drives.
   • CIt is inherently fragile and can be altered or destroyed by routine access.
   • DIt exists only in a physical form that can be touched and measured.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An examiner is investigating a workplace harassment complaint and finds personal emails on the suspect's company laptop that are unrelated to the case. The emails are not covered by the company's monitoring policy. What should the examiner do with this unrelated personal data?

   • AIgnore the emails and continue the investigation without noting them.
   • BDelete the emails to protect the employee's privacy.
   • CDocument the existence of the emails but do not include their contents in the report.
   • DInclude the emails in the report because they are on company property.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What information should be documented when evidence is transferred from one investigator to another?

   • AThe estimated monetary value of the evidence.
   • BThe date, time, and purpose of the transfer, along with the names of both parties.
   • CThe serial number of the evidence container only.
   • DThe weather conditions at the time of transfer.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An examiner is asked to investigate a suspected policy violation involving an employee's work computer. The company has a policy that states that all data on company computers is the property of the company and may be accessed at any time. The employee is not aware of this policy. What is the most important legal consideration for the examiner?

   • AWhether the examiner has the latest forensic software.
   • BWhether the computer is a laptop or a desktop.
   • CWhether the employee had a reasonable expectation of privacy.
   • DWhether the employee is a senior manager.
   Reveal Solution Discussion Select an answer first