EC-Council CHFI QUESTIONS AND ANSWERS |
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
Module 1: Computer Forensics in Today's World
,1. What is the primary goal of computer forensics?
A) To recover deleted files
B) To identify, preserve, analyze, and present digital evidence in a legally acceptable manner
C) To hack into systems and find vulnerabilities
D) To monitor employee internet usage
Answer: B
Rationale: Computer forensics is the application of investigation and analysis techniques to gather and preserve
evidence from a particular computing device in a way that is suitable for presentation in a court of law. The
primary goal is the legal admissibility of the evidence.
2. Which of the following is NOT a rule of evidence handling?
A) Preserve the original evidence
B) Analyze the original evidence to avoid data loss
C) Document the chain of custody
D) Minimize handling of the original evidence
Answer: B
Rationale: You should never analyze the original evidence. Instead, you must create a forensic image (a bit-
stream copy) and perform analysis on the copy to prevent modification of the original.
,3. What does the Locard's Exchange Principle state in the context of digital forensics?
A) Every contact leaves a trace
B) Evidence must be authenticated
C) The best evidence rule applies
D) Data is always volatile
Answer: A
Rationale: Locard's Exchange Principle, "every contact leaves a trace," applies to digital forensics as any
interaction with a system (e.g., logging in, running a program) leaves some form of digital artifact.
4. Which of the following best defines "chain of custody"?
A) A process of hashing evidence
B) A chronological documentation of the seizure, custody, control, transfer, analysis, and disposition of evidence
C) The sequence of events during an incident
D) A list of all files on a suspect's computer
Answer: B
Rationale: Chain of custody is the crucial documentation trail that shows who had control of the evidence at all
times, from seizure to presentation in court, to prove it has not been tampered with.
, 5. What is the role of a forensic investigator in a corporate environment?
A) To terminate employees who violate policy
B) To conduct investigations of security incidents and policy violations
C) To manage the company's firewall
D) To develop new software applications
Answer: B
Rationale: In a corporate setting, a forensic investigator's role is to investigate incidents such as data breaches,
intellectual property theft, and policy violations, and to support legal proceedings.
---
Module 2: Computer Forensics Investigation Process
6. What is the first step in the forensic investigation process?
A) Data analysis
B) Evidence acquisition
C) Identification of evidence
VERIFIED AND WELL DETAILED ANSWERS | PLUS
RATIONALES | GUARANTEED PASS | LATEST EXAM
UPDATE | EXAM PREP | STUDY GUIDE | PRACTICE
TEST
Module 1: Computer Forensics in Today's World
,1. What is the primary goal of computer forensics?
A) To recover deleted files
B) To identify, preserve, analyze, and present digital evidence in a legally acceptable manner
C) To hack into systems and find vulnerabilities
D) To monitor employee internet usage
Answer: B
Rationale: Computer forensics is the application of investigation and analysis techniques to gather and preserve
evidence from a particular computing device in a way that is suitable for presentation in a court of law. The
primary goal is the legal admissibility of the evidence.
2. Which of the following is NOT a rule of evidence handling?
A) Preserve the original evidence
B) Analyze the original evidence to avoid data loss
C) Document the chain of custody
D) Minimize handling of the original evidence
Answer: B
Rationale: You should never analyze the original evidence. Instead, you must create a forensic image (a bit-
stream copy) and perform analysis on the copy to prevent modification of the original.
,3. What does the Locard's Exchange Principle state in the context of digital forensics?
A) Every contact leaves a trace
B) Evidence must be authenticated
C) The best evidence rule applies
D) Data is always volatile
Answer: A
Rationale: Locard's Exchange Principle, "every contact leaves a trace," applies to digital forensics as any
interaction with a system (e.g., logging in, running a program) leaves some form of digital artifact.
4. Which of the following best defines "chain of custody"?
A) A process of hashing evidence
B) A chronological documentation of the seizure, custody, control, transfer, analysis, and disposition of evidence
C) The sequence of events during an incident
D) A list of all files on a suspect's computer
Answer: B
Rationale: Chain of custody is the crucial documentation trail that shows who had control of the evidence at all
times, from seizure to presentation in court, to prove it has not been tampered with.
, 5. What is the role of a forensic investigator in a corporate environment?
A) To terminate employees who violate policy
B) To conduct investigations of security incidents and policy violations
C) To manage the company's firewall
D) To develop new software applications
Answer: B
Rationale: In a corporate setting, a forensic investigator's role is to investigate incidents such as data breaches,
intellectual property theft, and policy violations, and to support legal proceedings.
---
Module 2: Computer Forensics Investigation Process
6. What is the first step in the forensic investigation process?
A) Data analysis
B) Evidence acquisition
C) Identification of evidence
