Security+ Digital Forensics Evidence Handling

1. In chain of custody documentation, which information is least critical to record?

Date, time, and person handling evidence

Purpose of each access

Color of the evidence storage container

Location and condition of evidence

2. Which regulation governs the handling of personally identifiable information (PII) during forensic investigations in Europe?

FISMA

GDPR

NIST guidelines

ISO 27001

Submit

6. Which of the following is a best practice for secure storage of digital evidence?

Store on public cloud servers

Use locked, temperature-controlled facilities with access logs

Keep multiple copies on personal devices

Store in shared network drives

7. True or False: Forensic investigators should always power off a suspect's computer immediately upon discovery to preserve evidence.

True

False

8. What is the primary concern when acquiring evidence from a cloud-based system?

Lack of physical access and jurisdictional issues

High equipment costs

Slow internet connection

Limited storage capacity

9. Which tool or technique is used to verify that a forensic image has not been altered since creation?

Antivirus scanning

Hash verification

Data compression

File fragmentation analysis

10. True or False: Forensic evidence can be legally used in court if the investigator followed proper procedures but did not document the chain of custody.

True

False

11. Which document is most critical for maintaining the integrity and admissibility of digital evidence in legal proceedings?

Chain of custody

Incident response plan

Security policy document

Risk assessment report

12. What is the primary benefit of using a dedicated forensic workstation for evidence analysis?

Lower equipment costs

Isolation from network threats and contamination

Faster processing speeds

Built-in encryption

13. Which of the following best describes 'bit-by-bit imaging' in forensics?

Copying only essential files

Creating an exact duplicate of all data sectors

Selective backup of user files

Incremental backup method

14. True or False: MD5 hash values are currently considered sufficient for verifying the integrity of forensic evidence in all legal contexts.

True

False

15. When collecting evidence from a network, what is the recommended approach to minimize data loss?

Isolate systems from the network first

Collect volatile data before shutting down

Use network packet sniffers continuously

Disconnect all cables immediately

16. Which regulation specifically requires organizations to maintain audit trails and preserve evidence for investigation?

HIPAA

SOX (Sarbanes-Oxley)

GDPR

PCI-DSS

17. What does the term 'spoliation' mean in the context of digital forensics?

Proper storage of evidence

Intentional or negligent destruction of evidence

Secure transmission of data

Documentation of findings

18. A forensic investigator must verify the integrity of acquired evidence. Which cryptographic method is most appropriate?

Symmetric encryption

Hash values (MD5, SHA-256)

Digital signatures only

Public key certificates

19. Which of the following is a proper first step when acquiring evidence from a live system?

Shut down the system immediately

Document the current state and volatile data

Begin full disk imaging

Delete temporary files

20. What is the primary purpose of write-blocking during digital forensics acquisition?

Compress data for storage

Prevent modification of source data

Encrypt sensitive information

Remove malware from the device

Security+ Digital Forensics Evidence Handling Quiz

1. In chain of custody documentation, which information is least critical to record?

2.

What first name or nickname would you like us to use?

2. Which regulation governs the handling of personally identifiable information (PII) during forensic investigations in Europe?

3. The ____ principle states that every contact leaves a trace of evidence.

4. A forensic ____ documents who handled evidence, when, and for what purpose.

5. The process of extracting data from unallocated space on a disk is called ____.

6. Which of the following is a best practice for secure storage of digital evidence?

7. True or False: Forensic investigators should always power off a suspect's computer immediately upon discovery to preserve evidence.

8. What is the primary concern when acquiring evidence from a cloud-based system?

9. Which tool or technique is used to verify that a forensic image has not been altered since creation?

10. True or False: Forensic evidence can be legally used in court if the investigator followed proper procedures but did not document the chain of custody.

11. Which document is most critical for maintaining the integrity and admissibility of digital evidence in legal proceedings?

12. What is the primary benefit of using a dedicated forensic workstation for evidence analysis?

13. Which of the following best describes 'bit-by-bit imaging' in forensics?

14. True or False: MD5 hash values are currently considered sufficient for verifying the integrity of forensic evidence in all legal contexts.

15. When collecting evidence from a network, what is the recommended approach to minimize data loss?

16. Which regulation specifically requires organizations to maintain audit trails and preserve evidence for investigation?

17. What does the term 'spoliation' mean in the context of digital forensics?

18. A forensic investigator must verify the integrity of acquired evidence. Which cryptographic method is most appropriate?

19. Which of the following is a proper first step when acquiring evidence from a live system?

20. What is the primary purpose of write-blocking during digital forensics acquisition?