4.2 - Understand and Support Forensic Investigations SSCP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   During a forensic investigation, an analyst discovers that a piece of evidence was briefly left unattended in an unlocked room. The analyst later documents this in the chain of custody. What is the MOST likely consequence of this lapse?

   • AThe investigation will be invalidated, and the case will be dismissed.
   • BThe analyst will be personally liable for any damages.
   • CThe evidence will be automatically excluded from the trial.
   • DThe evidence may be challenged in court, and its admissibility could be questioned.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   During an incident response, a forensic analyst must collect evidence from a compromised server. The server is running critical business applications and cannot be taken offline immediately. Which evidence source should the analyst prioritize?

   • ASystem logs from the SIEM, which are stored centrally.
   • BThe server's hard drive, which requires taking the server offline.
   • CNetwork connections and running processes from the live server.
   • DBackup tapes from the previous night.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard · select all that apply

   An incident responder is at a scene with multiple potential evidence sources: a running server, a switched-off laptop, a smartphone that is on, and a network switch. The responder must prioritize evidence collection. Which of the following should be collected FIRST? (Select all that apply.)

   • AThe laptop's hard drive, which is switched off.
   • BThe network switch's configuration and logs.
   • CThe contents of the running server's RAM.
   • DThe smartphone's screen contents and any active notifications.
   Check answers Discussion Select an answer first
5. 29foundation · easy

   A forensic investigator is about to seize a computer from an office. What is the best practice to preserve the scene and evidence?

   • APhotograph the entire scene and the computer's connections before touching anything
   • BTurn off the computer by pulling the power cord
   • CDisconnect all cables immediately to prevent remote access
   • DStart the computer to check if it is working
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A forensic team is investigating a server that was compromised. The server is part of a cluster that provides a critical service. The team must decide whether to take the server offline for a full forensic acquisition or keep it running to maintain service availability. What is the BEST approach?

   • AKeep the server running indefinitely and only collect network logs.
   • BClone the hard drive while the server is running using a hot-swap bay.
   • CPerform a live forensic acquisition of volatile data, then take the server offline for a full disk image.
   • DImmediately shut down the server to preserve the hard drive evidence.
   Reveal Solution Discussion Select an answer first