DIGITAL FORENSICS EXAMINATION QUESTIONS AND
CORRECT ANSWER WITH EXPLANATION|GRADED A+
STUDY GUIDE SOUTHERN NEW HAMPSHIRE UNIVERSITY
1. Digital forensics is primarily concerned with:
A. Building software
B. Investigating digital evidence
C. Network marketing
D. Hardware manufacturing
Answer: B
Rationale: Digital forensics focuses on investigating and analyzing digital evidence.
2. The main goal of digital forensics is to:
A. Design systems
B. Recover and preserve evidence
C. Increase system speed
D. Install software
Answer: B
Rationale: It ensures evidence is collected and preserved properly.
3. Chain of custody ensures:
A. Evidence integrity
B. Faster processing
C. Data encryption
D. System backup
Answer: A
Rationale: It maintains evidence authenticity and integrity.
4. Digital evidence must be:
,A. Altered for analysis
B. Preserved in original form
C. Deleted after review
D. Shared publicly
Answer: B
Rationale: Evidence must remain unchanged.
5. Forensic imaging means:
A. Editing files
B. Creating an exact copy of storage
C. Encrypting data
D. Compressing files
Answer: B
Rationale: Bit-by-bit copy of storage media.
6. Write blocker is used to:
A. Delete files
B. Prevent modification of evidence
C. Increase speed
D. Encrypt data
Answer: B
Rationale: Prevents writing to evidence drive.
7. Volatile data refers to:
A. Data lost when power is off
B. Permanent storage
C. Printed documents
D. Archived files
Answer: A
Rationale: RAM data disappears on shutdown.
8. Non-volatile data includes:
, A. RAM
B. Hard drives
C. Cache only
D. Registers
Answer: B
Rationale: Persistent storage retains data.
9. First responder in forensics should:
A. Reboot system
B. Preserve evidence
C. Install antivirus
D. Delete logs
Answer: B
Rationale: Avoid altering evidence.
10. RAM capture is important because it contains:
A. Volatile evidence
B. Printed files
C. Backup logs
D. Firmware only
Answer: A
Rationale: RAM holds active data.
11. Disk imaging tool example is:
A. FTK Imager
B. Notepad
C. Excel
D. Chrome
Answer: A
Rationale: Forensic imaging software.
12. Hashing is used to:
CORRECT ANSWER WITH EXPLANATION|GRADED A+
STUDY GUIDE SOUTHERN NEW HAMPSHIRE UNIVERSITY
1. Digital forensics is primarily concerned with:
A. Building software
B. Investigating digital evidence
C. Network marketing
D. Hardware manufacturing
Answer: B
Rationale: Digital forensics focuses on investigating and analyzing digital evidence.
2. The main goal of digital forensics is to:
A. Design systems
B. Recover and preserve evidence
C. Increase system speed
D. Install software
Answer: B
Rationale: It ensures evidence is collected and preserved properly.
3. Chain of custody ensures:
A. Evidence integrity
B. Faster processing
C. Data encryption
D. System backup
Answer: A
Rationale: It maintains evidence authenticity and integrity.
4. Digital evidence must be:
,A. Altered for analysis
B. Preserved in original form
C. Deleted after review
D. Shared publicly
Answer: B
Rationale: Evidence must remain unchanged.
5. Forensic imaging means:
A. Editing files
B. Creating an exact copy of storage
C. Encrypting data
D. Compressing files
Answer: B
Rationale: Bit-by-bit copy of storage media.
6. Write blocker is used to:
A. Delete files
B. Prevent modification of evidence
C. Increase speed
D. Encrypt data
Answer: B
Rationale: Prevents writing to evidence drive.
7. Volatile data refers to:
A. Data lost when power is off
B. Permanent storage
C. Printed documents
D. Archived files
Answer: A
Rationale: RAM data disappears on shutdown.
8. Non-volatile data includes:
, A. RAM
B. Hard drives
C. Cache only
D. Registers
Answer: B
Rationale: Persistent storage retains data.
9. First responder in forensics should:
A. Reboot system
B. Preserve evidence
C. Install antivirus
D. Delete logs
Answer: B
Rationale: Avoid altering evidence.
10. RAM capture is important because it contains:
A. Volatile evidence
B. Printed files
C. Backup logs
D. Firmware only
Answer: A
Rationale: RAM holds active data.
11. Disk imaging tool example is:
A. FTK Imager
B. Notepad
C. Excel
D. Chrome
Answer: A
Rationale: Forensic imaging software.
12. Hashing is used to:
