Unit 1: Computer Forensics and Investigation Process - Practice Quiz

1 What is the primary goal of computer forensics?

2 Which term describes the process of using scientific methods to examine digital devices for evidence?

3 Which of the following is an example of a cyber crime?

4 Cyber crimes are generally classified into which two broad categories?

5 Which of the following is the best example of digital evidence?

6 Which property of digital evidence means it can be easily altered or deleted?

7 What is used to ensure the integrity of digital evidence remains unchanged?

8 What does forensic readiness primarily aim to achieve for an organization?

9 A key benefit of forensic readiness is that it helps reduce which of the following?

10 What does the abbreviation SOC stand for in cybersecurity?

11 What is the main purpose of an incident response process?

12 Which is a core responsibility of a forensic investigator?

13 A forensic investigator may be required to do which of the following in a legal case?

14 Which of the following is a common challenge in investigating cyber crimes?

15 Why does the cross-border nature of cyber crime create investigation difficulties?

16 Why is legal compliance important in computer forensics?

17 Which document tracks the handling and movement of evidence from collection to court?

18 What is the correct high-level order of the forensic investigation process?

19 Which activity typically occurs during the pre-investigation phase?

20 What is a key priority during the first response at a crime scene?

21 An investigator applies scientific methods to preserve, identify, extract, and document digital evidence so it can be presented in court. Which principle is being followed when the original evidence is never altered during analysis?

22 A company detects that an attacker used a compromised employee account to transfer funds. Which classification best describes this cyber crime?

23 During an investigation, which type of digital evidence should be collected first based on the order of volatility?

24 An investigator hashes an evidence file at seizure and again after imaging, and both hashes match. What does this primarily demonstrate?

25 An organization pre-configures centralized logging, evidence-handling policies, and trained staff before any incident occurs. This proactive capability is best termed:

26 Which of the following is the primary business benefit of establishing forensic readiness?

27 A SOC analyst detects suspicious lateral movement and escalates it. Within incident response, this activity primarily supports which phase?

28 Why is coordination between the SOC and the forensic team important during an active incident?

29 A forensic investigator is asked to draw legal conclusions about a suspect's guilt in their report. What is the correct response?

30 Which responsibility most distinguishes a forensic investigator from a general IT administrator?

31 An attacker routes traffic through servers in multiple countries before reaching the victim. Which investigation challenge does this most directly create?

32 Investigators find that suspect files are encrypted with a strong algorithm and no key is available. This situation best illustrates which challenge?

33 An investigator seizes a personal laptop without a warrant or consent. What is the most likely legal consequence?

34 Which document primarily authorizes investigators to search and seize specific digital evidence at a location?

35 Why is following a standardized forensic investigation methodology critical?

36 Setting up a forensic lab, acquiring validated tools, and obtaining authorization all occur in which phase?

37 Why should forensic tools be validated before an investigation begins?

38 A first responder arrives at a scene with a running computer suspected of holding volatile evidence. What is the most appropriate initial action?

39 Which action by a first responder would most likely compromise the integrity of digital evidence?

40 During the investigation phase, an examiner works on a forensic image rather than the original drive. What is the main reason?

41 An investigator recovers a file whose logical size is 4,096 bytes but whose allocated cluster size is 8,192 bytes. Which forensic principle explains why the remaining 4,096 bytes may still contain evidentiary value?

42 During acquisition, an investigator computes an MD5 hash of a drive as a1b2... and later a SHA-256 hash as f9e8.... On re-verification months later, MD5 matches but SHA-256 differs. What is the MOST defensible conclusion?

43 Before seizing systems at a corporate site, the lead examiner insists on documenting the network topology and establishing a chain-of-custody template. Which pre-investigation objective does this BEST serve?

44 A first responder arrives at a running server suspected of active data exfiltration. Applying the order of volatility, which action should occur FIRST?

45 An organization wants to minimize the cost of future investigations while maximizing evidence usability. Which forensic readiness measure aligns BEST with this goal?

46 During incident response, a SOC analyst isolates an infected host but preserves its memory and disk before reimaging. Which tension is this workflow primarily balancing?

47 An examiner in the U.S. accesses a suspect's personal cloud account using credentials found on a seized laptop, without a specific warrant covering the cloud provider. What is the MOST likely legal consequence?

48 An attacker used a chain of proxies across multiple jurisdictions and full-disk encryption on the endpoint. Which combined challenge does this scenario MOST directly illustrate?

49 A forensic investigator discovers evidence that could exonerate the accused, but the client (prosecution) prefers it be omitted from the report. What is the investigator's correct professional obligation?

50 An examiner must analyze a 2 TB image but only has read-only access and limited time. Which analysis strategy BEST preserves integrity while improving efficiency?

51 In the post-investigation phase, why is a detailed, reproducible report considered more important than the raw tool output alone?

52 Investigators classify an insider who copied trade secrets to a USB drive as committing which category, and what investigative focus follows?

53 Why does skipping the identification/assessment step and jumping directly to acquisition often undermine an entire investigation?

54 A defense attorney challenges a memory dump because the acquisition tool itself ran on the target and altered a few KB of RAM. Which principle best frames the appropriate response?

55 An organization implements NTP synchronization across all servers as part of forensic readiness. Which investigative benefit does this MOST directly enable?

56 A multinational investigation must collect data stored on servers in the EU concerning EU residents. Which compliance consideration MOST directly constrains the collection?

57 A first responder finds a locked, running workstation displaying a chat window with incriminating text. Pulling the plug would clear RAM. What is the BEST immediate action?

58 An examiner encounters timestamps that appear deliberately backdated using a timestomping tool. Which cross-verification approach BEST detects the manipulation?

59 A SOC's SIEM raises a high-severity alert, but responders eradicate the threat before collecting artifacts. From a forensic standpoint, what is the primary loss?

60 Which statement BEST captures the relationship between the Daubert standard and forensic methodology in court?