Digital Forensics Week 02 Practice Quiz (18 Questions)

Score 11 or greater to pass.

DF6 W02: Q01. According to ACPO guidelines, what is a core practice when handling evidence in a computer forensics investigation?
Destroy the evidence once the court case finishes. Always make a case against the accused. Preserve and document all evidence.- Work with the latest operating system software.
DF6 W02: Q02. What is the primary purpose of creating full contemporaneous notes during a digital forensic investigation, as recommended by ACPO guidelines?
To provide rough outlines of tasks for personal reference. To enable third parties to verify the investigation steps taken. To help accountants accurately cost an investigation. To document only the tasks relevant to the court case.
DF6 W02: Q03. What is the name generally given to the third stage of the Digital Forensics process?
Analysis Collection Reporting Examination
DF6 W02: Q04. What is the name generally given to the final stage of the Digital Forensics process?
Examination Collection Analysis Reporting
DF6 W02: Q05. Who should secure digital evidence at a potential digital crime scene according to ACPO guidelines?
The owner of the digital assets. The first person on the scene. The highest ranking police officer. A suitably qualified person.
DF6 W02: Q06. Which of the following MUST be produced during a Digital Forensics investigation?
A signed clearance form from the judge accepting the authority of the key investigator. A download of key filenames and passwords. A collection of photographs of the hard disk from the crime scene. A comprehensive Audit Trail.
DF6 W02: Q07. Generally the first stage of a Digital Forensics investigation is referred to as Collection. Which of the following is another term for the first stage?
Reviewing Aquisition Developing Examining
DF6 W02: Q08. Which of the following shows the correct order of steps in a Digital Forensics investigation?
Examination, Reporting, Collection, and Analysis Collection, Examination, Analysis, and Reporting Analysis, Collection, Reporting, and Examination Reporting, Analysis, Examination, and Collection
DF6 W02: Q09. Which of the following locations would digital evidence NOT typically be found if a computer is switched off?
RAM USB Flash Drive HDD An ISP's Log Files
DF6 W02: Q10. Which one of the following laws makes hacking illegal?
The Equalities Act The Computer Misuse Act The Regulation of Investigatory Powers Act The Data Protection Act
DF6 W02: Q11. Which one of the following would be classed as system specific information?
USB Flash Drive's contents DNA Storage capacity of a system's HDD Footprints
DF6 W02: Q12. Which one of the following is a term used in the Digital Forensics field?
Open Windows Train of Evidence Local Warrant First Responder
DF6 W02: Q13. in line with ACPO guidelines, which of the following should a First Responder ENSURE before collecting evidence at a digital crime scene?
They carry out a formal interview with the suspect. Legal authority exists to seize evidence. They use a ROM Write blocker. They secure only mobile devices at the scene.
DF6 W02: Q14. Which of the following is regarded as an input device?
ROM Keyboard CPU Monitor
DF6 W02: Q15. Which of the following terms describes documentation that must be recorded at the time of a digital forensics investigation?
Judicial notes. Police Case Journal notes. Contemporaneous notes. Legal Statute notes.
DF6 W02: Q16. What number system is this an example of: 3A2B1C?
Binary Hex Octal Decimal
DF6 W02: Q17. What is the primary purpose of using a Faraday bag in a digital forensic investigation?
To increase Wi-Fi signal strength. To shield electronic devices from electromagnetic signals. To prevent physical damage to electronic devices. To encrypt data stored on electronic devices.
DF6 W02: Q18. Why would a digital forensic investigator use a write blocker when analyzing a hard drive?
To take a snapshot of the disk contents for later use To prevent any changes from being made to the drive’s contents during analysis. To overwrite any unused space on the drive To enable faster reading of the drive’s contents