Question 1

When an organization itself is under investigation, it is always feasible to collect all the data for every system.

Accepted Answer

A) True 
 B)False  False

Question 2

During the initial survey of a crime scene, why it is necessary to photograph or videotape the area and items of potential interest in their current state?

Accepted Answer

A)   This simplifies inventorying the crime scene.
B)   Photographing items to be seized records their actual condition, and precludes damage claims when the items are returned to the offender.
C)   To record the fact that a particular item was actually found at the crime scene.
D)   None of the above. C

Question 3

Since crime scenes are typically pretty much the same, very little planning needs to take place prior to first entering the scene.

Accepted Answer

A) True 
 B)False  False

Question 4

The crime scene preservation process includes all but which of the following:

Accepted Answer

A)   Protecting against unauthorized alterations
B)   Acquiring digital evidence
C)   Confirming system date and time
D)   Controlling access to the crime scene

Question 5

When a first responder encounters technology or equipment that he is not familiar with, the recommended course of action is to:

Accepted Answer

A)   Seize the equipment as if it were a known device
B)   Seek assistance from a more experienced digital investigator
C)   Leave that particular piece of equipment at the crime scene
D)   Ask the suspect for details on the equipment

Question 6

When performing triage at a crime scene, an important first step is to turn on any computers that are off and immediately look for items of evidence.

Accepted Answer

A) True 
 B)False

Question 7

The likelihood of collecting notable information from a running computer is relatively small, so it is safe to shut down any running computer to preserve the data on the hard drive.

Accepted Answer

A) True 
 B)False

Question 8

Examples of data that should be immediately preserved include:

Accepted Answer

A)   USB drives
B)   Digital picture frames
C)   System and network information
D)   USB bracelets

Question 9

What considerations are there when developing a crime scene plan?

Accepted Answer

The answer of What considerations are there when developing a...

Question 10

When entering a crime scene, the initial survey should:

Accepted Answer

A)   Include user manuals
B)   Involve tracing cables
C)   Collect relevant data such as passwords and account details
D)   All of the above

Question 11

When preparing a questionnaire for interviewing individuals of the crime scene which of the following should NOT be requested:

Accepted Answer

A)   Passwords
B)   Encryption keys
C)   Admission of guilt
D)   Details on removable storage

Question 12

The proper collection of evidence at a crime scene is crucial in terms of admissibility in court.

Accepted Answer

A) True 
 B)False

Question 13

When first entering a crime scene, the first responder should immediately focus on the computers and technology.

Accepted Answer

A) True 
 B)False

Question 14

In the case where digital investigators dealing with distributed systems need to collect data from remote sites, the following procedure is recommended:

Accepted Answer

A)   Notify personnel at the remote sites to leave everything as is, and arrange for travel to the remote locations
B)   Notify personnel at the remote sites to shut down all systems and send the hard drives to the forensic lab
C)   Utilize remote forensics tools to acquire data from the remote sites' RAM as well as the hard drives
D)   None of the above

Question 15

The following organizations have published guidelines for handling digital crime scenes:

Accepted Answer

A)   US Secret Service
B)   Association of Chief Police Officers
C)   US Department of Justice
D)   All of the above

Question 16

The challenge to controlling access to a digital crime scene is that:

Accepted Answer

A)   Information may be stored on Internet servers in different locations.
B)   The computer may be shared.
C)   The computer case may be locked.
D)   None of the above.

Question 17

When shutting down a live system it is generally recommended to unplug the power from the back of the computer.

Accepted Answer

A) True 
 B)False

Question 18

The Fourth Amendment, like ECPA, only applies to the government, not the private sector.

Accepted Answer

A) True 
 B)False

Question 19

When presenting evidence on an organizational network, the digital investigator may require the assistance of:

Accepted Answer

A)   System administrators
B)   The CEO of the organization
C)   The CSO (Chief Security Officer) 
D)   Additional forensic investigators

Question 20

Capturing volatile data or specific files from a live system is a straightforward process usually handled by the first responder.

Accepted Answer

A) True 
 B)False

Exam 7: Handling a Digital Crime Scene

When an organization itself is under investigation, it is always feasible to collect all the data for every system.

During the initial survey of a crime scene, why it is necessary to photograph or videotape the area and items of potential interest in their current state?

Since crime scenes are typically pretty much the same, very little planning needs to take place prior to first entering the scene.

The crime scene preservation process includes all but which of the following:

When a first responder encounters technology or equipment that he is not familiar with, the recommended course of action is to:

When performing triage at a crime scene, an important first step is to turn on any computers that are off and immediately look for items of evidence.

The likelihood of collecting notable information from a running computer is relatively small, so it is safe to shut down any running computer to preserve the data on the hard drive.

Examples of data that should be immediately preserved include:

What considerations are there when developing a crime scene plan?

When entering a crime scene, the initial survey should:

When preparing a questionnaire for interviewing individuals of the crime scene which of the following should NOT be requested:

The proper collection of evidence at a crime scene is crucial in terms of admissibility in court.

When first entering a crime scene, the first responder should immediately focus on the computers and technology.

In the case where digital investigators dealing with distributed systems need to collect data from remote sites, the following procedure is recommended:

The following organizations have published guidelines for handling digital crime scenes:

The challenge to controlling access to a digital crime scene is that:

When shutting down a live system it is generally recommended to unplug the power from the back of the computer.

The Fourth Amendment, like ECPA, only applies to the government, not the private sector.

When presenting evidence on an organizational network, the digital investigator may require the assistance of:

Capturing volatile data or specific files from a live system is a straightforward process usually handled by the first responder.