CSIA EXAM SCRIPT PREMIUM REVIEW
SHEET TESTED QUESTIONS AND ANSWERS
●● Chain of custody
Answer: In a forensic investigation, what documents the evidence-
gathering process and includes the history and possession of a sample
from the time of its collection to its final disposition?
●● arp
Answer: What command displays the mappings between different layers
of the network architecture?
●● DriveSpy
Answer: What disk-forensic tool creates direct disk-to-disk forensic
duplicates and can copy a range of sectors within or between drives?
●● Search warrant
Answer: What is a written order issued by a judge that directs a law
enforcement officer to search for a particular piece of evidence at a
particular location?
●● Time-frame analysis
,Answer: What process can contribute to associating events that occurred
on a computer with a particular individual?
●● Slack space
Answer: What represents the space that exists between the end of the file
and the end of the last cluster used by that file?
●● Incident
Answer: What term defines an event that threatens the security of a
computer system or network in an organization?
●● Best practices
Answer: What term defines is defined as an empirically proven set of
methods for performing a task in the best and most efficient way?
●● Bit-stream copy
Answer: Which of the following refers to a bit-by-bit copy of the
original storage medium?
●● Location where obtained
Answer: A chain of custody document contains the following
information about the obtained evidence:
●● as potential evidence
, Answer: How should electronic devices gathered at a crime scene be
treated?
●● Volatility
Answer: What is the term that measures of how perishable electronically
stored data is?
●● exhibit numbering
Answer: What procedure requires evidence to be marked using the
format aaa/ddmmyy/nnnn/zz?
●● identify the scene
Answer: What should a first responder do immediately after arriving at a
crime scene?
●● File cabinet
Answer: Which of the following is NOT a potential source for electronic
evidence?
●● it should be photographed
Answer: identify the scene
●● first responder toolkit
SHEET TESTED QUESTIONS AND ANSWERS
●● Chain of custody
Answer: In a forensic investigation, what documents the evidence-
gathering process and includes the history and possession of a sample
from the time of its collection to its final disposition?
●● arp
Answer: What command displays the mappings between different layers
of the network architecture?
●● DriveSpy
Answer: What disk-forensic tool creates direct disk-to-disk forensic
duplicates and can copy a range of sectors within or between drives?
●● Search warrant
Answer: What is a written order issued by a judge that directs a law
enforcement officer to search for a particular piece of evidence at a
particular location?
●● Time-frame analysis
,Answer: What process can contribute to associating events that occurred
on a computer with a particular individual?
●● Slack space
Answer: What represents the space that exists between the end of the file
and the end of the last cluster used by that file?
●● Incident
Answer: What term defines an event that threatens the security of a
computer system or network in an organization?
●● Best practices
Answer: What term defines is defined as an empirically proven set of
methods for performing a task in the best and most efficient way?
●● Bit-stream copy
Answer: Which of the following refers to a bit-by-bit copy of the
original storage medium?
●● Location where obtained
Answer: A chain of custody document contains the following
information about the obtained evidence:
●● as potential evidence
, Answer: How should electronic devices gathered at a crime scene be
treated?
●● Volatility
Answer: What is the term that measures of how perishable electronically
stored data is?
●● exhibit numbering
Answer: What procedure requires evidence to be marked using the
format aaa/ddmmyy/nnnn/zz?
●● identify the scene
Answer: What should a first responder do immediately after arriving at a
crime scene?
●● File cabinet
Answer: Which of the following is NOT a potential source for electronic
evidence?
●● it should be photographed
Answer: identify the scene
●● first responder toolkit
