Which technique is used to preserve the integrity of a hard drive during forensic acquisition?

Deleting temporary files to free up space

Booting the system to create a memory dump

Formatting the drive before making a copy

A forensic investigator is preparing a report on a data breach that involved a malware infection. The report will be reviewed by the company's legal team and senior management. What is the MOST appropriate way to present the findings?

Focus only on the malware's technical details, such as its hash and family.

State conclusions without explaining the methods, to keep the report brief.

Include every raw log entry and packet capture in the main body of the report.

Provide a clear summary of the incident, the evidence collected, and the analysis methods used.

Systems Security Certified Practitioner

Domain 4Objective 2

4.2 - Understand and Support Forensic Investigations SSCP Practice Questions (Page 3)

Part of the Incident Response and Recovery domain, which accounts for 14% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

7concepts

14%of the exam

Questions 11–15

11foundation · easy
Which legal framework is most likely to govern a forensic investigation that is conducted to determine whether an employee violated the organization's internal acceptable use policy?
Select an answer first
12foundation · easy
Which technique is used to preserve the integrity of a hard drive during forensic acquisition?
Select an answer first
13foundation · easy
An investigator is collecting evidence from a computer that may be used in a civil lawsuit. Which ethical principle is most important to ensure the evidence is accepted by the court?
Select an answer first
14foundation · easy
During an incident response, which of the following evidence sources is the MOST volatile and therefore should be collected first?
Select an answer first
15application · medium
A forensic investigator is preparing a report on a data breach that involved a malware infection. The report will be reviewed by the company's legal team and senior management. What is the MOST appropriate way to present the findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.

4.2 - Understand and Support Forensic Investigations SSCP Practice Questions (Page 3)

Questions 11–15

Which legal framework is most likely to govern a forensic investigation that is conducted to determine whether an employee violated the organization's internal acceptable use policy?

Which technique is used to preserve the integrity of a hard drive during forensic acquisition?

An investigator is collecting evidence from a computer that may be used in a civil lawsuit. Which ethical principle is most important to ensure the evidence is accepted by the court?

During an incident response, which of the following evidence sources is the MOST volatile and therefore should be collected first?

A forensic investigator is preparing a report on a data breach that involved a malware infection. The report will be reviewed by the company's legal team and senior management. What is the MOST appropriate way to present the findings?

Keep studying — Incident Response and Recovery