C702 Exam with Questions and Answers |Fall
2026/2027 Update | 100% Correct Latest (Graded A+)
Which of the following is not an objective of computer forensics?
A. Computer forensics deals with the process of finding evidence related to a digital
crime to find the victims and prevent legal action against them.
B. Computer forensics deals with the process of finding evidence related to a crime to
find the culprits and initiate legal action against them.
C. Computer forensics deals with the process of finding evidence related to a digital
crime to find the culprits and initiate legal action against them.
D. Computer forensics deals with the process of finding evidence related to a digital
crime to find the culprits and avoid legal action against them. -
CORRECT-ANSWERSC
Which of the following is not an objective of computer forensics?
A. Track and prosecute the perpetrators in a court of law.
B. Identify, gather, and preserve the evidence of a cybercrime.
C. Interpret, document, and present the evidence to be admissible during
prosecution.
D. Document vulnerabilities allowing further loss of intellectual property,
finances, and reputation during an attack. - CORRECT-ANSWERSD
Which legal document allows law enforcement to search an office, place of
business, or other locale for evidence relating to an alleged crime?
A. bench warrant
B. search warrant
C. wire tap
D. subpoena - CORRECT-ANSWERSB
Before you are called to testify as an expert, what must an attorney do first?
A. read your curriculum vitae to the jury B.
engage in damage control
C. qualify you as an expert witness
D. prove that the tools you used to conduct your examination are perfect -
CORRECT-ANSWERSC
,A state department site was recently attacked and all the servers had their hard disks
erased. The incident response team sealed the area and commenced investigation.
During evidence collection, they came across a zip disk that did not have the standard
labeling on it. The incident team ran the disk on an isolated system and found that the
system disk was accidentally erased. They decided to call in the FBI for further
investigation. Meanwhile, they short listed possible suspects including three summer
interns. Where did the incident team go wrong?
A. They examined the actual evidence on an unrelated system
B. They called in the FBI without correlating with the fingerprint data C. They
attempted to implicate personnel without proof
D. They tampered with the evidence by using it - CORRECT-ANSWERSD
During the course of an investigation, you locate evidence that may prove the
innocence of the suspect of the
investigation. You must maintain an unbiased opinion and be objective in your entire
fact finding process. Therefore you report this evidence. This type of evidence is known
as:
A. Mandatory evidence
B. Exculpatory evidence
C. Inculpatory evidence
D. Terrible evidence - CORRECT-ANSWERSB
Jason is the security administrator of ACMA metal Corporation. One day he notices
that the company's Oracle database server has been compromised and the customer
information along with financial data has been stolen. The financial loss will be in
millions of dollars if the database gets into the hands of the competitors. Jason wants
to report this crime to the law enforcement agencies immediately. Which organization
coordinates computer crimes investigations throughout the United States?
A. CERT Coordination Center
B. Internet Fraud Complaint Center
C. National Infrastructure Protection Center
D. Local or national office of the U.S. Secret Service - CORRECT-ANSWERSC
When performing a forensics analysis, what device is used to prevent the system
from recording data on an evidence disk?
A. a protocol analyzer
B. a disk editor
C. a write-blocker
D. a firewall - CORRECT-ANSWERSC
,What should you do when approached by a reporter about a case that you are
working on or have worked on?
A. refer the reporter to the attorney that retained you B. say,
"no comment"
C. answer only the questions that help your case
D. answer all the reporters questions as completely as possible - CORRECT-
ANSWERSA
If you plan to startup a suspect's computer, you must modify the ___________
to ensure that you do not contaminate or alter data on the suspect's hard drive by
booting to the hard drive.
A. Boot.sys
B. CMOS
C. deltree command
D. Scandisk utility - CORRECT-ANSWERSB
When reviewing web logs, you see an entry for resource not found in the HTTP
status code field. What is the actual error code that you would see in the log for
resource not found?
A. 606
B. 404
C. 202
D. 909 - CORRECT-ANSWERSB
During the course of a corporate investigation, you find that an employee is
committing a crime. Can the employer file a criminal complain with the police?
A. no, because the investigation was conducted without following standard police
procedures B. no, because the investigation was conducted without a warrant
C. yes, but only if you turn the evidence over to a federal law enforcement agencyD.
yes, and all evidence can be turned over to the police - CORRECT-
ANSWERSD
You are assigned to work in the computer forensics lab of a state police agency. While
working on a high profile criminal case, you have followed every applicable procedure,
however your boss is still concerned that the defense attorney might question wheather
evidence has been changed while at the lab. What can you do to prove that the
evidence is the same as it was when it first entered the lab?
, A. make an MD5 hash of the evidence and compare it with the original MD5 hash that
was taken when the evidence first entered the lab
B. there is no reason to worry about this possible claim because state labs are
certified
C. sign a statement attesting that the evidence is the same as it was when it entered
the lab
D. make an MD5 hash of the evidence and compare it to the standard
database developed by NIST - CORRECT-ANSWERSA
Windows identifies which application to open a file with by examining which of the
following?
A. The file extension
B. The file signature at the beginning of the file C.
The file attributes
D. The file signature at the end of the file - CORRECT-ANSWERSA
Which of the following is true regarding the enterprise theory of investigation (ETI) ?
A. It adopts a holistic approach toward any criminal activity as a criminal operation
rather than as a single criminal act.
B. It adopts an approach toward criminal activity as a criminal act.
C. It differs from traditional investigative methods, and it is less complex and less time-
consuming.
D. It encourages reactive action on the structure of the criminal enterprise. -
CORRECT-ANSWERSA
Forensic readiness referrers to:
A. having no impact on prospects of successful legal action B.
replacing the need to meet all regulatory requirements
C. the establishment of specific incident response procedures and
designated trained personnel to prevent a breach
D. an organization's ability to make optimal use of digital evidence in a limited
time period and with minimal investigation costs - CORRECT-
ANSWERSD
Which of the following is not an element of cybercrime?
A. anonymity through masquerading
B. fast-paced speed
C. volatile evidence
D. evidence smaller in size - CORRECT-ANSWERSD
2026/2027 Update | 100% Correct Latest (Graded A+)
Which of the following is not an objective of computer forensics?
A. Computer forensics deals with the process of finding evidence related to a digital
crime to find the victims and prevent legal action against them.
B. Computer forensics deals with the process of finding evidence related to a crime to
find the culprits and initiate legal action against them.
C. Computer forensics deals with the process of finding evidence related to a digital
crime to find the culprits and initiate legal action against them.
D. Computer forensics deals with the process of finding evidence related to a digital
crime to find the culprits and avoid legal action against them. -
CORRECT-ANSWERSC
Which of the following is not an objective of computer forensics?
A. Track and prosecute the perpetrators in a court of law.
B. Identify, gather, and preserve the evidence of a cybercrime.
C. Interpret, document, and present the evidence to be admissible during
prosecution.
D. Document vulnerabilities allowing further loss of intellectual property,
finances, and reputation during an attack. - CORRECT-ANSWERSD
Which legal document allows law enforcement to search an office, place of
business, or other locale for evidence relating to an alleged crime?
A. bench warrant
B. search warrant
C. wire tap
D. subpoena - CORRECT-ANSWERSB
Before you are called to testify as an expert, what must an attorney do first?
A. read your curriculum vitae to the jury B.
engage in damage control
C. qualify you as an expert witness
D. prove that the tools you used to conduct your examination are perfect -
CORRECT-ANSWERSC
,A state department site was recently attacked and all the servers had their hard disks
erased. The incident response team sealed the area and commenced investigation.
During evidence collection, they came across a zip disk that did not have the standard
labeling on it. The incident team ran the disk on an isolated system and found that the
system disk was accidentally erased. They decided to call in the FBI for further
investigation. Meanwhile, they short listed possible suspects including three summer
interns. Where did the incident team go wrong?
A. They examined the actual evidence on an unrelated system
B. They called in the FBI without correlating with the fingerprint data C. They
attempted to implicate personnel without proof
D. They tampered with the evidence by using it - CORRECT-ANSWERSD
During the course of an investigation, you locate evidence that may prove the
innocence of the suspect of the
investigation. You must maintain an unbiased opinion and be objective in your entire
fact finding process. Therefore you report this evidence. This type of evidence is known
as:
A. Mandatory evidence
B. Exculpatory evidence
C. Inculpatory evidence
D. Terrible evidence - CORRECT-ANSWERSB
Jason is the security administrator of ACMA metal Corporation. One day he notices
that the company's Oracle database server has been compromised and the customer
information along with financial data has been stolen. The financial loss will be in
millions of dollars if the database gets into the hands of the competitors. Jason wants
to report this crime to the law enforcement agencies immediately. Which organization
coordinates computer crimes investigations throughout the United States?
A. CERT Coordination Center
B. Internet Fraud Complaint Center
C. National Infrastructure Protection Center
D. Local or national office of the U.S. Secret Service - CORRECT-ANSWERSC
When performing a forensics analysis, what device is used to prevent the system
from recording data on an evidence disk?
A. a protocol analyzer
B. a disk editor
C. a write-blocker
D. a firewall - CORRECT-ANSWERSC
,What should you do when approached by a reporter about a case that you are
working on or have worked on?
A. refer the reporter to the attorney that retained you B. say,
"no comment"
C. answer only the questions that help your case
D. answer all the reporters questions as completely as possible - CORRECT-
ANSWERSA
If you plan to startup a suspect's computer, you must modify the ___________
to ensure that you do not contaminate or alter data on the suspect's hard drive by
booting to the hard drive.
A. Boot.sys
B. CMOS
C. deltree command
D. Scandisk utility - CORRECT-ANSWERSB
When reviewing web logs, you see an entry for resource not found in the HTTP
status code field. What is the actual error code that you would see in the log for
resource not found?
A. 606
B. 404
C. 202
D. 909 - CORRECT-ANSWERSB
During the course of a corporate investigation, you find that an employee is
committing a crime. Can the employer file a criminal complain with the police?
A. no, because the investigation was conducted without following standard police
procedures B. no, because the investigation was conducted without a warrant
C. yes, but only if you turn the evidence over to a federal law enforcement agencyD.
yes, and all evidence can be turned over to the police - CORRECT-
ANSWERSD
You are assigned to work in the computer forensics lab of a state police agency. While
working on a high profile criminal case, you have followed every applicable procedure,
however your boss is still concerned that the defense attorney might question wheather
evidence has been changed while at the lab. What can you do to prove that the
evidence is the same as it was when it first entered the lab?
, A. make an MD5 hash of the evidence and compare it with the original MD5 hash that
was taken when the evidence first entered the lab
B. there is no reason to worry about this possible claim because state labs are
certified
C. sign a statement attesting that the evidence is the same as it was when it entered
the lab
D. make an MD5 hash of the evidence and compare it to the standard
database developed by NIST - CORRECT-ANSWERSA
Windows identifies which application to open a file with by examining which of the
following?
A. The file extension
B. The file signature at the beginning of the file C.
The file attributes
D. The file signature at the end of the file - CORRECT-ANSWERSA
Which of the following is true regarding the enterprise theory of investigation (ETI) ?
A. It adopts a holistic approach toward any criminal activity as a criminal operation
rather than as a single criminal act.
B. It adopts an approach toward criminal activity as a criminal act.
C. It differs from traditional investigative methods, and it is less complex and less time-
consuming.
D. It encourages reactive action on the structure of the criminal enterprise. -
CORRECT-ANSWERSA
Forensic readiness referrers to:
A. having no impact on prospects of successful legal action B.
replacing the need to meet all regulatory requirements
C. the establishment of specific incident response procedures and
designated trained personnel to prevent a breach
D. an organization's ability to make optimal use of digital evidence in a limited
time period and with minimal investigation costs - CORRECT-
ANSWERSD
Which of the following is not an element of cybercrime?
A. anonymity through masquerading
B. fast-paced speed
C. volatile evidence
D. evidence smaller in size - CORRECT-ANSWERSD
