4.2 - Understand and Support Forensic Investigations SSCP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A forensic analyst has completed the imaging of a hard drive and is about to begin analysis. To ensure the evidence can be used in court, what should the analyst do with the original hard drive?

   • AStore it in a secure evidence locker and document its location and access.
   • BReturn it to the employee immediately to avoid disruption.
   • CUse it as the working copy for analysis to save time.
   • DErase it to protect the company's confidential data.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A multinational company is investigating a suspected intellectual property theft. The suspect is an employee who works remotely from a country with strict data privacy laws. The company's legal counsel has approved the investigation, but the employee's personal devices may contain relevant data. What is the MOST appropriate legal consideration?

   • AThe company can seize all personal devices without restriction because the employee is suspected of a crime.
   • BThe company can ignore local laws because the investigation is for internal purposes.
   • CThe company must notify the employee before any forensic examination of their devices.
   • DThe company must respect the employee's privacy rights under local laws, which may require a court order or specific consent.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An incident responder is called to a scene where a server is still running and a laptop is found closed. The responder must prioritize evidence collection. Which evidence should be collected FIRST?

   • APhotographs of the physical scene.
   • BA list of all users currently logged into the server.
   • CThe contents of RAM from the running server.
   • DThe hard drive from the closed laptop.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A forensic analyst is testifying in court about a digital forensic examination. The defense attorney asks the analyst to explain how the chain of custody was maintained for the evidence. What is the MOST important information the analyst should provide?

   • AThe analyst's personal opinion about the suspect's guilt.
   • BThe company's security policy regarding investigations.
   • CThe technical specifications of the forensic tools used.
   • DA detailed log of every person who handled the evidence, with dates and times.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   An investigator hands a hard drive to a lab technician for analysis. What must the investigator do to maintain the chain of custody?

   • AProvide the technician with the password to the hard drive
   • BDocument the transfer with a signature and timestamp from both parties
   • CMake a copy of the hard drive and give the copy to the technician
   • DEmail the technician a summary of the evidence
   Reveal Solution Discussion Select an answer first