Module 4 Quiz

Question 1

You should always answer questions from onlookers at a crime scene.

True

False

Answer 1

False

Question 2

If a suspect’s computer is found in an area that might have toxic chemicals, you must do which of the following?

Coordinate with the HAZMAT team.

Determine a way to obtain the suspect’s computer.

Assume the suspect’s computer is contaminated.

Do not enter alone.

Answer 2

Coordinate with the HAZMAT team.

Question 3

What are the three rules for a forensic hash?

Fast, reliable, and the hash value should be at least 2048 bits

Produce collisions, should be at least 2048 bits, and it can’t be predicted

It can’t be predicted, no two files can have the same hash value, and if the file changes, the hash value changes

It can be predicted, fast and reliable

Answer 3

It can’t be predicted, no two files can have the same hash value, and if the file changes, the hash value changes

Question 4

The plain view doctrine in computer searches is well-established law.

True

False

Answer 4

False

Question 5

Commingling evidence means that sensitive or confidential information being mixed with data collected as evidence.

True

False

Answer 5

True

Question 6

List two hashing algorithms commonly used for forensic purposes.

MD5 and SHA-1

MD5 and AES

AES and SHA-2

RSA and RC5

Answer 6

MD5 and SHA-1

Question 7

Small companies rarely need investigators.

True

False

Answer 7

False

Question 8

In forensic hashes, a collision occur when two different files have the same hash value.

True

False

Answer 8

True

Question 9

As a private-sector investigator, you can become an agent of law enforcement when which of the following happens?

You begin to take orders from a police detective without a warrant or subpoena.

Your internal investigation has concluded, and you have filed a criminal complaint and turned over the evidence to law enforcement.

Your internal investigation begins.

None of the above.

Answer 9

You begin to take orders from a police detective without a warrant or subpoena.

Question 10

An initial-response field kit does not contain evidence bags.

True

False

Answer 10

False

Question 11

If you discover a criminal act while investigating a company policy abuse, the case becomes a criminal investigation and should be referred to law enforcement.

True

False

Answer 11

True

Question 12

Private-sector investigations are typically easier than law enforcement investigations for which of the following reasons?

Most companies keep inventory databases of all hardware and software used.

The investigator doesn’t have to get a warrant.

The investigator has to get a warrant.

Users can load whatever they want on their machines.

Answer 12

Most companies keep inventory databases of all hardware and software used.

Question 13

You have been called to the scene of a fatal car crash where a laptop computer is still running. What type of field kit should you take with you?

Extensive-response kit

Initial-response kit

Lightweight kit

Car crash kit

Answer 13

Initial-response kit

Question 14

You should videotape or sketch anything at a digital crime scene that might be of interest to the investigation.

True

False

Answer 14

True

Question 15

Computer peripherals or attachments can contain DNA evidence.

True

False

Answer 15

True

Question 16

If a company doesn’t distribute a computing use policy stating an employer’s right to inspect employees’ computers freely, including e-mail and Web use, employees have an expectation of privacy.

True

False

Answer 16

True

Question 17

Which of the following techniques might be used in covert surveillance (Choose All That Apply)?

Keylogging

Data sniffing

Network logs

All of the above

Answer 17

Keylogging

Data sniffing

Question 18

When you arrive at the scene, why should you extract only those items you need to acquire evidence?

To conceal trade secrets

To preserver your physical security

To speed up the acquisition process

To minimize how much you have to keep track of at the scene

Answer 18

To minimize how much you have to keep track of at the scene

Question 19

In the United States, if a company publishes a policy stating that it reserves the right to inspect computing assets at will, a private-sector investigator can conduct covert surveillance on an employee with little cause.

True

False

Answer 19

True