Forensic Evidence Collection Quiz

What is the first step in desktop forensics following a security incident?

• Reviewing system logs

• Confiscation of devices

• Using a forensic analysis tool

• Reviewing user activity

Which of the following is a challenge associated with live forensics?

• Reviewing files and settings

• Capturing data in active memory

• Using a forensic analysis tool

• Reviewing user activity

In network forensics, what must be ensured before scanning local infrastructure?

• That the system is offline

• That permission is granted

• That all devices are confiscated

• That malware analysis is complete

Which tool is used in desktop forensics to create a copy of the system?

• A malware analysis tool

• A forensic analysis tool

• A system imaging tool

• A network scanning tool

What is the purpose of reviewing system logs in forensic analysis?

• To confiscate devices

• To capture data in active memory

• To identify user activity and system events

• To agree on a network-testing methodology

Which of the following is NOT a part of desktop forensics?

• Reviewing user activity

• Analysing malware activity and alerts

• Taking an image of the system

• Reviewing files and settings

What is a key consideration when using passive and active analysis tools in network forensics?

• Ensuring the system is offline

• Ensuring the testing protocol will not disrupt a live system

• Ensuring all devices are confiscated

• Ensuring malware analysis is complete

What is the main goal of malware analysis in forensic investigations?

• To confiscate devices

• To recover corrupted data

• To understand malware behaviour and alerts

• To review system logs

Which of the following is a challenge in recovering corrupted data during live forensics?

• Losing temporary files

• Reviewing user activity

• Using a forensic analysis tool

• Reviewing files and settings

In network forensics, what is the purpose of reviewing and analysing firewalls and infrastructure devices?

• To confiscate devices

• To ensure permission is granted

• To identify and understand network activity and potential breaches

• To capture data in active memory