Forensic Evidence Collection Quiz

What is the primary purpose of forensic collection of evidence following a security incident?

• To punish the perpetrator

• To understand the incident and prevent future occurrences

• To delete all compromised data

• To sell the data to third parties

Which of the following is a requirement for desktop forensics?

• Ignoring system logs

• Confiscation of devices

• Deleting user activity records

• Avoiding malware analysis

What is a challenge associated with live forensics?

• Ensuring data remains unchanged

• Capturing data in active memory

• Easily recovering temporary files

• Avoiding data corruption

In network forensics, what must be agreed upon with the forensic supervisory and investigatory authority?

• The type of malware to be used

• A network-testing methodology

• The number of devices to confiscate

• The amount of data to delete

What is essential when scanning local infrastructure in network forensics?

• Ensuring permission is granted

• Disrupting the live system

• Ignoring firewall logs

• Deleting all server logs

What is a requirement for maintaining an accurate record during forensic analysis?

• Recording findings weeks after the incident

• Retaining snapshots of the system

• Ignoring any alterations made

• Creating false evidence

Why is it important to evaluate the findings in forensic analysis?

• To create confusion

• To determine if they provide evidence of a crime

• To delete all evidence

• To sell the findings

What should be considered to ensure evidence is not a false positive?

• Ignoring the reliability of the evidence

• Ensuring the evidence is relevant

• Deleting all irrelevant data

• Creating additional false positives

What is a recommendation to prevent future security incidents?

• Ignoring cyber security documentation

• Improving security protection measures

• Deleting all security policies

• Avoiding adherence to agreements

Which of the following is NOT a part of desktop forensics?

• Reviewing system logs

• Confiscation of devices

• Analysing malware activity

• Ignoring user activity