Unit 1: Computer Forensics and Investigation Process - Practice Quiz

1 What is computer forensics primarily concerned with?

2 Which principle helps ensure that original digital evidence is not altered during examination?

3 Which activity is an example of cybercrime?

4 What should investigators generally obtain before searching a suspect's computer when required by law?

5 Which item is an example of digital evidence?

6 What does a chain of custody document?

7 What is the main goal of forensic readiness?

8 Which organizational practice best supports forensic readiness?

9 What is incident response?

10 Which action is commonly performed to contain a compromised computer?

11 What is a primary function of a Security Operations Center?

12 How can a SOC support a computer forensic investigation?

13 Which task is a responsibility of a forensic investigator?

14 Why must a forensic investigator remain objective?

15 Why is a structured forensic investigation process important?

16 Which activity normally occurs during a forensic investigation process?

17 Which activity belongs to the pre-investigation phase?

18 Why are legal requirements reviewed before collecting digital evidence?

19 What should a first responder do upon arriving at a digital incident scene?

20 What is the purpose of analyzing collected digital evidence during the investigation phase?

21 An investigator must acquire data from a suspect's hard drive without modifying the original media. Which approach is most appropriate?

22 Two forensic images independently acquired from the same drive have matching SHA-256 hashes and complete acquisition logs. What is the best inference?

23 Employees report a phishing email that may have led to account compromise. Which initial investigative action best preserves useful evidence?

24 During an unauthorized-access investigation, web server logs and firewall logs appear to show events in the wrong order because the systems used different clock settings. What should the investigator do?

25 Investigators encounter a powered-on laptop that may use full-disk encryption. If collection is authorized, which evidence should generally be prioritized before shutdown?

26 A working copy of an evidence image produces a hash that differs from the verified master image. What is the most appropriate response?

27 An organization repeatedly lacks sufficient logs to investigate compromised accounts. Which improvement would most directly increase forensic readiness?

28 A company wants to reduce the time spent locating evidence after incidents. Which preparedness activity best supports that objective?

29 Ransomware is actively spreading from an employee workstation. Which response best balances containment and evidence preservation?

30 A compromised server has been contained, but responders have not yet collected forensic data. What should occur before the server is rebuilt?

31 A SOC detects related alerts from an endpoint, firewall, and identity system. What action best supports a later forensic investigation?

32 The SOC must export logs from its SIEM for a forensic investigator. Which procedure provides the strongest integrity assurance?

33 An investigator discovers evidence that contradicts the incident manager's theory and may support the suspect. What should the investigator do?

34 An evidence drive is transferred from one investigator to another. Which record is most important for maintaining the chain of custody?

35 An analyst reports results from a forensic tool without validating the tool or independently checking important findings. What is the primary risk?

36 A search authorization permits examination of one specified email account, but an investigator discovers a potentially relevant second account. What should happen next?

37 A planned investigation may require records held by a cloud provider in another jurisdiction. Which pre-investigation action is most appropriate?

38 A first responder finds a running computer displaying suspicious command activity. What is the best initial approach?

39 A keyword search finds a document containing a suspect's name in unallocated disk space. What should the investigator do before concluding that the suspect created it?

40 File timestamps conflict with authentication logs during timeline analysis. Which action best resolves the discrepancy?

41 An authorized investigator encounters a running Linux server suspected of hosting a kernel-level rootkit. An encrypted volume is mounted, and shutting down the server will destroy its decryption keys. Which acquisition strategy best balances evidentiary preservation and forensic risk?

42 Two validated forensic tools analyze the same verified image but disagree about whether an unallocated byte sequence represents a deleted file. What is the most defensible response?

43 A company discovers that a cloud account was used to distribute malware. Relevant provider logs are retained for only seven days, while the provider stores them in another jurisdiction. What should investigators prioritize?

44 During a business email compromise investigation, a message in the victim's mailbox appears to have been sent by the chief financial officer. Which evidence set provides the strongest basis for distinguishing account takeover from simple address spoofing?

45 A source drive and its forensic image have different whole-device hashes. The acquisition log records three unreadable sectors that the imaging tool replaced with zeros after repeated retries. Which conclusion is most accurate?

46 A copied document has a creation timestamp later than the incident, but its contents describe events during the incident. Which approach best assesses whether the document existed at the relevant time?

47 An organization proposes retaining all employee network payloads indefinitely to maximize forensic readiness. Which redesign best preserves investigative capability while addressing proportionality and privacy?

48 A SaaS provider retains detailed audit logs for seven days, but the organization's mean incident detection time is twelve days. Which readiness measure most directly closes the evidence gap?

49 An actively compromised domain controller is sending data to an attacker. Disconnecting it may terminate volatile sessions, but leaving it connected permits further loss. Which action best reconciles response and forensic priorities?

50 A ransomware-affected workstation remains powered on. Encryption activity has stopped, but an active command-and-control connection remains. Full-disk encryption is enabled. What is the best immediate response?

51 A SOC query identifies the same malicious file hash on 50 endpoints, but enrichment fields in the SIEM are updated dynamically. What should the SOC preserve for forensic use?

52 A SOC analyst exports a packet capture, calculates its hash, and places it in a restricted case repository for transfer to the forensic team. Which additional action is essential for a defensible handoff?

53 An investigator retained by management finds evidence that weakens management's preferred theory and supports the employee under investigation. What is the investigator's primary professional obligation?

54 Legal counsel asks an investigator to state that a specific foreign group conducted an intrusion. The evidence establishes use of infrastructure previously associated with that group, but the infrastructure is commercially rentable. How should the investigator respond?

55 Evidence shows that an administrator account deleted files shortly after unauthorized access. Which analytical method best avoids prematurely concluding that the administrator performed the deletion?

56 While examining allocated project files under narrowly defined authority for intellectual-property theft, an investigator encounters signs of an unrelated offense outside the authorized scope. What is the most defensible next step?

57 A multinational company requests examination of an employee-owned device used for work in several countries. Before collection, what is the most important pre-investigation action?

58 A collection plan covers eight devices, each with a capacity of . The plan requires one forensic master and one full working copy per device, with no compression or deduplication. If storage must include 25% overhead, how much usable capacity is required?

59 A first responder finds an unlocked, powered laptop with full-disk encryption, active cloud sessions, and a risk of remote destruction. The responder is authorized and trained to collect volatile evidence. What should be done first?

60 A firewall records an event at 10:00:00 UTC. An endpoint records the related event at 10:03:00, and testing shows that the endpoint clock was consistently 180 seconds fast with an uncertainty of seconds. How should the endpoint event be represented in the normalized timeline?