IS4670Chapter 7 Collecting, Seizing, and Protecting Evidence

Question 1

1. No two investigations are the same.
   A. True
   B. False

Answer 1

TRUE

Question 2

2. Which of the following is not a step in the process of collecting and analyzing evidence?
A. Identifying the evidence 
B. Preserving the evidence 
C. Creating the evidence 
D. Analyzing the evidence 
E. Presenting the evidence

Answer 2

Creating the evidence

Question 3

3. Which of the following is the best type of evidence to support a case?
A. Testimonial evidence 
B. Real evidence 
C. Hearsay 
D. Rules of evidence

Answer 3

Real evidence

Question 4

4. Admissibility, authenticity, completeness, reliability, and believability are called the ________.

Answer 4

Five rules of evidence

Question 5

5. Never store system logs on a remote server.
   A. True
   B. False

Answer 5

FALSE

Question 6

6. When is the best time to notify law enforcement when dealing with a breach?
   A. Immediately after the breach is suspected
   B. After evidence collection has begun
   C. After the attacker is identified
   D. It depends on the circumstances of the case.

Answer 6

It depends on the circumstances of the case.

Question 7

7. Which of the following is a data collection process that involves creating a replica system and luring an attacker into it for further monitoring?
A. Collecting artifacts 
B. Honeypotting 
C. Freezing the scene 
D. Sandboxing

Answer 7

Honeypotting

Question 8

8. Which of the following are important factors in maintaining the chain of custody? (Select three.)
   A. Keeping evidence within an investigator’s possession or control at all times
   B. Locking the evidence in an airtight chamber
   C. Documenting the collection and movement of evidence
   D. Securing the evidence appropriately so it can’t be tampered with
   E. Videotaping all data collection

Answer 8

Keeping evidence within an investigator’s possession or control at all times

Documenting the collection and movement of evidence

Securing the evidence appropriately so it can’t be tampered with

Question 9

9. To search a hard drive for forensic evidence, an investigator should prepare a list of keywords to search for. What are the three main areas of a system that should be searched for these keywords? (Select three.)
A. C: drive 
B. Swap file 
C. Recycle Bin 
D. File slack 
E. Unallocated space

Answer 9

Swap file

File slack

Unallocated space

Question 10

10. Forensic investigators should never use originals. Instead, they should use verified duplicates.
    A. True
    B. False

Answer 10

TRUE

Question 11

11. The ________ is a detailed list of what was done with original copies and systems after they were seized.

Answer 11

Chain of custody

Question 12

12. An investigator should set the clock on a suspect system to the GMT time zone.
    A. True
    B. False

Answer 12

FALSE