What is the primary purpose of using a write blocker when acquiring digital evidence from a hard drive?

To create a compressed copy of the data to save storage space

To prevent any data from being written to the original drive during acquisition

To speed up the data acquisition process

To encrypt the data on the original drive to protect it from unauthorized access

What is the primary purpose of an investigative report in a security incident?

To assign blame to the individuals responsible for the incident

To provide a clear, factual account of the investigation that can be used in legal proceedings

To provide a detailed technical analysis of the malware involved

To summarize the incident for public relations purposes

An investigator is examining a suspect's smartphone for evidence of unauthorized data access. The phone is locked, and the investigator has a warrant. Which technique is most likely to preserve evidence while gaining access?

Use a forensic tool to perform a physical acquisition of the device's storage.

Ask the suspect to provide the passcode.

Guess the passcode based on the suspect's personal information.

Perform a logical acquisition of the device's accessible data.

A security team is investigating a suspected insider threat. The suspect's laptop is running, and the team has legal authorization to seize it. However, the laptop is encrypted with BitLocker, and the suspect is still logged in. The team must preserve evidence while minimizing disruption to the organization's operations. What is the best course of action?

Ask the suspect to provide the BitLocker recovery key before proceeding.

Power off the laptop immediately and then remove the hard drive for imaging.

Perform a live acquisition of the laptop's memory and then create a forensic image of the disk while the system is running.

Copy the user's profile folder to an external drive.

Certified Information Systems Security Professional

Domain 7Objective 1

7.1 - Understand and Comply with Investigations CISSP Practice Questions (Page 2)

Part of the Security Operations domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–1 from this objective — we provide 29 practice questions to prepare you well beyond it. (estimate)

29questions here

6free pages

5concepts

13%of the exam

Questions 6–10

6foundation · easy
What is the primary purpose of using a write blocker when acquiring digital evidence from a hard drive?
Select an answer first
7foundation · easy
What is the primary purpose of an investigative report in a security incident?
Select an answer first
8expert · hard
An investigator is examining a suspect's smartphone for evidence of unauthorized data access. The phone is locked, and the investigator has a warrant. Which technique is most likely to preserve evidence while gaining access?
Select an answer first
9expert · hard
A security team is investigating a suspected insider threat. The suspect's laptop is running, and the team has legal authorization to seize it. However, the laptop is encrypted with BitLocker, and the suspect is still logged in. The team must preserve evidence while minimizing disruption to the organization's operations. What is the best course of action?
Select an answer first
10foundation · easy
During an investigation, an analyst reviews system logs to identify unauthorized access patterns. Which investigative technique is being applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.

7.1 - Understand and Comply with Investigations CISSP Practice Questions (Page 2)

Questions 6–10

What is the primary purpose of using a write blocker when acquiring digital evidence from a hard drive?

What is the primary purpose of an investigative report in a security incident?

An investigator is examining a suspect's smartphone for evidence of unauthorized data access. The phone is locked, and the investigator has a warrant. Which technique is most likely to preserve evidence while gaining access?

During an investigation, an analyst reviews system logs to identify unauthorized access patterns. Which investigative technique is being applied?

Keep studying — Security Operations