CIS 484 Final - All Quizes and answers
already passed 2026/2027
The professional conduct of a digital forensics examiner includes the ethics, morals and standards of
behavior of the examiner; it is imperative that the examiner exhibit the highest levels of professional
behavior at all times.
T/F - correct answer ✔True
__________ is not recommended for a digital forensics workstation.
A test editor tool
A write-blocker device
A SCSI card
All of the above - correct answer ✔All of the above are recommended.
Many digital investigations in the private sector involve misuse of computing assets or company time.
T/F - correct answer ✔True
If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting
attorney might direct him or her to submit a(n) _______.
Affidavit
Memo
Verdict
Exhibit - correct answer ✔Affidavit
,When conducting a digital forensics analysis under attorney-client privilege (ACP) rules for an attorney,
you must keep all findings confidential unless you are forced to disclose information as a testifying
expert.
T/F - correct answer ✔True
Which option below is not a standard systems analysis step?
Determine a preliminary design or approach to the case
Share evidence with experts outside of the investigation
Obtain and copy an evidence drive
Mitigate or minimize the risks - correct answer ✔Share evidence with experts outside of the
investigation.
It is not important for the physical security of a digital forensics lab to be maintained since evidence is
stored in a digital format?
T/F - correct answer ✔False
A chain-of-custody form is used to document the location of evidence throughout a case and contains
information that can be used to uniquely identify the evidence such as serial numbers, model numbers,
and a description of the evidence.
T/F - correct answer ✔True
Which amendment to the US Constitution protects everyone's right to be secure in their person,
residence, and property from search and seizure? - correct answer ✔The Fourth Ammendment
, A bit-stream copy is a file containing a bit-stream copy of all data on a disk or disk partition, and is
usually referred to as an "image," "image save," or "image file"
T/F - correct answer ✔False -This is a bit stream image
Corporate policies governing computer use are important in the context of digital forensics because
well-defined policies give computer investigators and forensic examiners the authority to conduct and
investigation.
T/F - correct answer ✔True
Signed into law in 1973, the __________ was/were created to ensure consistency in federal
proceedings. - correct answer ✔Federal Rules of Evidence
It is common for digital forensic investigators to have at least one (1) mobile workstation for field work
and one (1) heavy-duty workstation for in-lab work.
T/F - correct answer ✔True
After the evidence has been presented in a trial by jury, the jury must deliver a(n) ___________. -
correct answer ✔verdict
Logical/targeted acquisitions may be best suited under which of the following circumstances?
Limited time
Only need specific files
Only granted access to certain files
All of the Above - correct answer ✔All of the above
already passed 2026/2027
The professional conduct of a digital forensics examiner includes the ethics, morals and standards of
behavior of the examiner; it is imperative that the examiner exhibit the highest levels of professional
behavior at all times.
T/F - correct answer ✔True
__________ is not recommended for a digital forensics workstation.
A test editor tool
A write-blocker device
A SCSI card
All of the above - correct answer ✔All of the above are recommended.
Many digital investigations in the private sector involve misuse of computing assets or company time.
T/F - correct answer ✔True
If a police officer or investigator has sufficient cause to support a search warrant, the prosecuting
attorney might direct him or her to submit a(n) _______.
Affidavit
Memo
Verdict
Exhibit - correct answer ✔Affidavit
,When conducting a digital forensics analysis under attorney-client privilege (ACP) rules for an attorney,
you must keep all findings confidential unless you are forced to disclose information as a testifying
expert.
T/F - correct answer ✔True
Which option below is not a standard systems analysis step?
Determine a preliminary design or approach to the case
Share evidence with experts outside of the investigation
Obtain and copy an evidence drive
Mitigate or minimize the risks - correct answer ✔Share evidence with experts outside of the
investigation.
It is not important for the physical security of a digital forensics lab to be maintained since evidence is
stored in a digital format?
T/F - correct answer ✔False
A chain-of-custody form is used to document the location of evidence throughout a case and contains
information that can be used to uniquely identify the evidence such as serial numbers, model numbers,
and a description of the evidence.
T/F - correct answer ✔True
Which amendment to the US Constitution protects everyone's right to be secure in their person,
residence, and property from search and seizure? - correct answer ✔The Fourth Ammendment
, A bit-stream copy is a file containing a bit-stream copy of all data on a disk or disk partition, and is
usually referred to as an "image," "image save," or "image file"
T/F - correct answer ✔False -This is a bit stream image
Corporate policies governing computer use are important in the context of digital forensics because
well-defined policies give computer investigators and forensic examiners the authority to conduct and
investigation.
T/F - correct answer ✔True
Signed into law in 1973, the __________ was/were created to ensure consistency in federal
proceedings. - correct answer ✔Federal Rules of Evidence
It is common for digital forensic investigators to have at least one (1) mobile workstation for field work
and one (1) heavy-duty workstation for in-lab work.
T/F - correct answer ✔True
After the evidence has been presented in a trial by jury, the jury must deliver a(n) ___________. -
correct answer ✔verdict
Logical/targeted acquisitions may be best suited under which of the following circumstances?
Limited time
Only need specific files
Only granted access to certain files
All of the Above - correct answer ✔All of the above
