4.2 - Understand and Support Forensic Investigations SSCP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key characteristic of a well-written forensic analysis report?

   • AIt uses technical jargon to demonstrate the investigator's expertise
   • BIt clearly describes the methods used and the evidence found
   • CIt includes the investigator's personal opinion about the suspect's guilt
   • DIt is written in a way that supports the prosecution's case
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   During a forensic investigation, an investigator needs to examine a computer that is part of a crime scene. The computer is currently running. What is the BEST practice to preserve the integrity of the evidence?

   • APerform a live acquisition of volatile data before powering down the system.
   • BRun a disk defragmentation tool to organize the data before imaging.
   • CCopy all files from the system to an external drive using the operating system's copy command.
   • DImmediately pull the power cord to prevent any further changes to the system.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A first responder is called to a scene where a computer is running and the user is unconscious. The responder suspects the computer contains evidence of a crime. The responder must decide whether to perform a live acquisition or shut down the computer. What is the MOST important factor in this decision?

   • AThe volatility of the data on the computer and the likelihood of losing it if the system is shut down.
   • BThe type of crime suspected and the legal authority of the responder.
   • CThe user's medical condition and the need to call an ambulance.
   • DThe availability of forensic tools and the responder's training.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An investigator is prioritizing evidence collection from multiple sources. Which source should be collected FIRST based on the principle of volatility?

   • AThe system's page file
   • BA USB flash drive found next to the computer
   • CThe system's event logs
   • DThe system's routing table
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company's incident response team is about to investigate a suspected policy violation by an employee. The company's security policy requires that all investigations be conducted with the approval of legal counsel. However, the legal counsel is unavailable for several days. What is the BEST course of action?

   • AProceed with the investigation and obtain approval retroactively.
   • BWait for legal counsel's approval before starting the investigation.
   • CIgnore the policy because the investigation is urgent.
   • DStart with non-invasive steps, such as reviewing logs, while waiting for approval.
   Reveal Solution Discussion Select an answer first