Digital Forensic Fundamentals GCFE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   During an investigation, an examiner needs to transport a seized hard drive from the client's office to the forensic lab. The drive is in an anti-static bag and is not in a locked container. What is the most important action to maintain chain of custody during transport?

   • AMake a bit-for-bit copy of the drive before transport.
   • BKeep the drive in the examiner's possession at all times and document every transfer.
   • CSend the drive via a courier service without special instructions.
   • DPlace the drive in a padded envelope to protect it from physical damage.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   An examiner is investigating a case where a suspect's computer was found to contain child exploitation material. The examiner is also a parent and is deeply disturbed by the content. What is the most appropriate action for the examiner to take?

   • AImmediately delete the disturbing content to prevent it from being seen by others.
   • BContinue the analysis but avoid documenting the disturbing content to protect the examiner's mental health.
   • CStop the analysis and refer the case to another examiner, as the material is too disturbing.
   • DContinue the analysis and document the findings, but seek professional support if the material is affecting the examiner's well-being.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which legal principle requires that digital evidence be obtained in a manner that respects an individual's reasonable expectation of privacy?

   • AThe Sarbanes-Oxley Act
   • BThe Electronic Communications Privacy Act (ECPA) only
   • CThe Fourth Amendment (in the U.S.)
   • DThe Freedom of Information Act (FOIA)
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   An examiner is collecting evidence from a computer that is part of a larger network. The examiner has identified a file that is relevant to the case. The file is stored on a network share that is accessed by multiple users. What is the best way to preserve the file?

   • ACopy the file to a forensic image and calculate a hash of the copy.
   • BMove the file to a secure location on the same share.
   • CDelete the file to prevent it from being altered.
   • DTake the network share offline to prevent further access.
   Reveal Solution Discussion Select an answer first
6. 40expert · hard

   A forensic examiner is collecting evidence from a corporate network. The examiner needs to preserve evidence from a server that is critical to the company's operations. The server cannot be taken offline. What is the most appropriate approach?

   • ACopy the entire hard drive using a write blocker while the server is running.
   • BWait until the server can be taken offline and then perform a forensic image.
   • CTake the server offline immediately to ensure the evidence is preserved.
   • DPerform a live acquisition of the server's memory and capture the relevant files while the server is running.
   Reveal Solution Discussion Select an answer first