Security+ Digital Forensics Evidence Handling

1. What is the primary purpose of write-blocking during digital forensics acquisition?

Compress data for storage

Prevent modification of source data

Encrypt sensitive information

Remove malware from the device

2. Which regulation governs the handling of personally identifiable information (PII) during forensic investigations in Europe?

FISMA

GDPR

NIST guidelines

ISO 27001

3. Which of the following is a best practice for secure storage of digital evidence?

Store on public cloud servers

Use locked, temperature-controlled facilities with access logs

Keep multiple copies on personal devices

Store in shared network drives

4. What is the primary concern when acquiring evidence from a cloud-based system?

Lack of physical access and jurisdictional issues

High equipment costs

Slow internet connection

Limited storage capacity

5. What is the primary benefit of using a dedicated forensic workstation for evidence analysis?

Lower equipment costs

Isolation from network threats and contamination

Faster processing speeds

Built-in encryption

6. Which of the following best describes 'bit-by-bit imaging' in forensics?

Copying only essential files

Creating an exact duplicate of all data sectors

Selective backup of user files

Incremental backup method

7. When collecting evidence from a network, what is the recommended approach to minimize data loss?

Isolate systems from the network first

Collect volatile data before shutting down

Use network packet sniffers continuously

Disconnect all cables immediately

8. Which regulation specifically requires organizations to maintain audit trails and preserve evidence for investigation?

HIPAA

SOX (Sarbanes-Oxley)

GDPR

PCI-DSS

9. What does the term 'spoliation' mean in the context of digital forensics?

Proper storage of evidence

Intentional or negligent destruction of evidence

Secure transmission of data

Documentation of findings

10. A forensic investigator must verify the integrity of acquired evidence. Which cryptographic method is most appropriate?

Symmetric encryption

Hash values (MD5, SHA-256)

Digital signatures only

Public key certificates

11. Which of the following is a proper first step when acquiring evidence from a live system?

Shut down the system immediately

Document the current state and volatile data

Begin full disk imaging

Delete temporary files

12. True or False: MD5 hash values are currently considered sufficient for verifying the integrity of forensic evidence in all legal contexts.

True

False

13. In chain of custody documentation, which information is least critical to record?

Date, time, and person handling evidence

Purpose of each access

Color of the evidence storage container

Location and condition of evidence

14. True or False: Forensic evidence can be legally used in court if the investigator followed proper procedures but did not document the chain of custody.

True

False

15. Which tool or technique is used to verify that a forensic image has not been altered since creation?

Antivirus scanning

Hash verification

Data compression

File fragmentation analysis

16. True or False: Forensic investigators should always power off a suspect's computer immediately upon discovery to preserve evidence.

True

False

17. Which document is most critical for maintaining the integrity and admissibility of digital evidence in legal proceedings?

Chain of custody

Incident response plan

Security policy document

Risk assessment report

Submit

Security+ Digital Forensics Evidence Handling Quiz

1. What is the primary purpose of write-blocking during digital forensics acquisition?

2.

What first name or nickname would you like us to use?

2. Which regulation governs the handling of personally identifiable information (PII) during forensic investigations in Europe?

3. Which of the following is a best practice for secure storage of digital evidence?

4. What is the primary concern when acquiring evidence from a cloud-based system?

5. What is the primary benefit of using a dedicated forensic workstation for evidence analysis?

6. Which of the following best describes 'bit-by-bit imaging' in forensics?

7. When collecting evidence from a network, what is the recommended approach to minimize data loss?

8. Which regulation specifically requires organizations to maintain audit trails and preserve evidence for investigation?

9. What does the term 'spoliation' mean in the context of digital forensics?

10. A forensic investigator must verify the integrity of acquired evidence. Which cryptographic method is most appropriate?

11. Which of the following is a proper first step when acquiring evidence from a live system?

12. True or False: MD5 hash values are currently considered sufficient for verifying the integrity of forensic evidence in all legal contexts.

13. In chain of custody documentation, which information is least critical to record?

14. True or False: Forensic evidence can be legally used in court if the investigator followed proper procedures but did not document the chain of custody.

15. Which tool or technique is used to verify that a forensic image has not been altered since creation?

16. True or False: Forensic investigators should always power off a suspect's computer immediately upon discovery to preserve evidence.

17. Which document is most critical for maintaining the integrity and admissibility of digital evidence in legal proceedings?

18. The process of extracting data from unallocated space on a disk is called ____.

19. A forensic ____ documents who handled evidence, when, and for what purpose.

20. The ____ principle states that every contact leaves a trace of evidence.