Chapter 14 Student 12

Question 1

You are at the crime scene. You seal off the area so that no one can touch or tamper with the scene. Only people that are aiding in the investigation will be allowed in the area and they would be documented when they entered and exited the crime scene. Which forensic concept is this? Pg 501

Answer 1

Secure the area

Question 2

When there is a lawsuit, the exchange of evidence by both sides is called a discovery. ________________ is basically discovery, but with emails, electronic documents, etc. Pg 502

Answer 2

eDiscovery

Question 3

T or F. You are collecting evidence. Using the order of volatility, you should collect the file systems information before you collect the contents of the memory. Pg 502

Answer 3

False. Memory contents are always first, then eventually you would collect the system processes.

Question 4

T or F. You are the guy that will be driving the evidence from the crime scene to the crime lab. All pieces of the evidence must be documented including who had access to the evidence. Pg 504

Answer 4

True

Question 5

T or F. During the eDiscovery process, if there is evidence that is deemed relevant, it may be placed on legal hold. While on legal hold no one is allowed to make copies of the data. Pg 503

Answer 5

True

Question 6

A third party (ISCA) came to your work today to examine the company’s security. They interviewed fellow employees and looked around work areas for any security breaches. What is going on? Pg 504

Answer 6

Security Audit

Question 7

There was an security breach at your laboratory. You boss tells you that he wants you to go to the site, and you are responsible for securing the scene and protecting any data from corruption. What did your boss just task you with? Pg 501

Answer 7

First responder

Question 8

Your boss wants to secure the network by having FTP Servers, Web servers, Email servers, etc separated from the private network and also separated from the Internet. What is your boss talking about creating? Pg 506-507

Answer 8

DMZ

Question 9

What is a clearly written document that fully identifies and explains what’s expected of them, and what they can and cannot do, and it will show the consequences for breaking the rules? Pg 508

Answer 9

Security policy

Question 10

So yo screwed up and got yourself fired. Your previous employer calls you and wants you to come in one last time and talk to a human resources representative. Your work belongings get turned in and your access to the company is terminated. What process are you going through? Pg 509

Answer 10

Exit interview