Computer Forensics Exam 1 UPDATED
ACTUAL Questions and CORRECT
Answers
You should always prove the allegations made by the person who hired you. - CORRECT
ANSWER - False
What's the purpose of an affidavit? - CORRECT ANSWER - To provide facts in support
of evidence of a crime to submit to a judge when requesting a search warrant
Why should you critique your case after it's finished? - CORRECT ANSWER - To
improve your work
You shouldn't include a narrative of what steps you took in your case report - CORRECT
ANSWER - False
Data collected before an attorney issues a memo for an attorney-client privilege case is protected
under the confidential work product rule. - CORRECT ANSWER - False
A warning banner should never state that the organization has the right to monitor what users do.
- CORRECT ANSWER - False
Why should evidence media be write-protected? - CORRECT ANSWER - To make sure
data isn't altered
What is one of the necessary components of a search warrant? - CORRECT ANSWER -
Signature of an impartial judicial officer
Digital forensics and data recovery refer to the same activities. - CORRECT ANSWER -
False
, Police in the United States must use procedures that adhere to which of the following? -
CORRECT ANSWER - Fourth amendment
The purpose of maintaining a network of digital forensics specialists is to develop a list of
colleagues who specialize in areas different from your own specialties in case you need help on
an investigation. - CORRECT ANSWER - True
One way to determine the resources needed for an investigation is based on the OS of the suspect
computer, list the software needed for the examination. - CORRECT ANSWER - True
Why is professional conduct important? - CORRECT ANSWER - It includes ethics,
morals, and standards of behavior
Policies can address rules for which of the following? - CORRECT ANSWER - All
Embezzlement is a type of digital investigation typically conducted in a business environment. -
CORRECT ANSWER - True
What do you call a list of people who have had physical possession of the evidence? -
CORRECT ANSWER - Chain of custody
The triad of computing security includes which of the following? - CORRECT
ANSWER - Vulnerability/threat assessment and risk management, network intrusion
detection and incident response, and digital investigation
List three items that should be on an evidence custody form. - CORRECT ANSWER -
Case number, name of the investigator and nature of the case
For digital evidence, an evidence bag is typically made of antistatic material. - CORRECT
ANSWER - true
ACTUAL Questions and CORRECT
Answers
You should always prove the allegations made by the person who hired you. - CORRECT
ANSWER - False
What's the purpose of an affidavit? - CORRECT ANSWER - To provide facts in support
of evidence of a crime to submit to a judge when requesting a search warrant
Why should you critique your case after it's finished? - CORRECT ANSWER - To
improve your work
You shouldn't include a narrative of what steps you took in your case report - CORRECT
ANSWER - False
Data collected before an attorney issues a memo for an attorney-client privilege case is protected
under the confidential work product rule. - CORRECT ANSWER - False
A warning banner should never state that the organization has the right to monitor what users do.
- CORRECT ANSWER - False
Why should evidence media be write-protected? - CORRECT ANSWER - To make sure
data isn't altered
What is one of the necessary components of a search warrant? - CORRECT ANSWER -
Signature of an impartial judicial officer
Digital forensics and data recovery refer to the same activities. - CORRECT ANSWER -
False
, Police in the United States must use procedures that adhere to which of the following? -
CORRECT ANSWER - Fourth amendment
The purpose of maintaining a network of digital forensics specialists is to develop a list of
colleagues who specialize in areas different from your own specialties in case you need help on
an investigation. - CORRECT ANSWER - True
One way to determine the resources needed for an investigation is based on the OS of the suspect
computer, list the software needed for the examination. - CORRECT ANSWER - True
Why is professional conduct important? - CORRECT ANSWER - It includes ethics,
morals, and standards of behavior
Policies can address rules for which of the following? - CORRECT ANSWER - All
Embezzlement is a type of digital investigation typically conducted in a business environment. -
CORRECT ANSWER - True
What do you call a list of people who have had physical possession of the evidence? -
CORRECT ANSWER - Chain of custody
The triad of computing security includes which of the following? - CORRECT
ANSWER - Vulnerability/threat assessment and risk management, network intrusion
detection and incident response, and digital investigation
List three items that should be on an evidence custody form. - CORRECT ANSWER -
Case number, name of the investigator and nature of the case
For digital evidence, an evidence bag is typically made of antistatic material. - CORRECT
ANSWER - true
