**** Kindly answer from the options 1 to 5 ****

QUESTION 1

Some forensic certifications include (choose all that apply):

1. CFE.
2. EnCE.
3. GIAC.
4. ACE.
5. CFHI.

QUESTION 2

Maintaining the chain of custody is (choose all that apply):

1. An integral part of preserving evidence.
2. Used only in administrative proceedings.
3. Used only in judicial proceedings.
4. An integral part of authenticating evidence.
5. For both physical and digital evidence.

QUESTION 3

Pre-investigation considerations require:

1. Determining your capabilities in the field or the lab.
2. A one-time cost.
3. Conducting a forensic examination.
4. Greater efficiency.
5. Security clearance.

QUESTION 4

1. The forensic analysis process includes (choose all that apply):
2. Pre-investigation considerations.
3. Understanding hash values.
4. Reporting your findings.
5. Understanding data destruction.
6. Understanding legal issues.

QUESTION 5

Pelican cases are particularly useful because they:

1. Are lightweight and easy to carry.
2. Act as a Faraday bag.
3. Are sturdy and waterproof.
4. Transport pelicans.
5. Come in many colours.

QUESTION 6

Hash analysis can be used to (choose all that apply):

1. Identify files.
2. Verify the integrity of evidence.
3. Determine file types.
4. Crack complex passwords.
5. Exclude files.

QUESTION 7

Notepads in the response kit are useful for (choose all that apply):

1. Keeping a reminder list.
2. Documenting who secured the scene.
3. Documenting the basic facts of the scene.
4. Documentation of your actions on the scene.
5. Making sketches as required.

QUESTION 8

The best working copy for a digital forensic exam is:

1. A forensic image.
2. A forensic copy.
3. A forensic copy or image.
4. A logical forensic image.
5. The original evidence

QUESTION 9

Forensic software is (choose all that apply):

• Optional to license.
• Multifaceted in the commercial versions.
• Available as CLI or GUI tools.
• Only available in commercial format.
• Used in analysing data.

QUESTION 10

Working copies of digital evidence come in the following formats (choose all that apply):

1. A bit-for-bit copy.
2. The original evidence.
3. A logical forensic image.
4. A forensic image.
5. Source data in a plastic wrapper.

QUESTION 11

Single-use items in the forensic kit should be:

1. Used sparingly.
2. Eliminated.
3. The responsibility of the lead investigator.
4. Replaced as soon as the incident ends.
5. Replaced before heading into the field.

QUESTION 12

Software security keys are also called:

1. RAM.
2. Thumb drives.
3. USB drives.
4. Dongles.
5. Apps.

QUESTION 13

Understanding case information and legal issues includes:

1. Knowing the rationale behind the search.
2. Dodging questions from superiors.
3. Consulting with your lawyer.
4. Research on social media.
5. Ignoring the limitations placed by a warrant.

QUESTION 14

As technology changes, so do the methods of (choose all that apply):

1. Budgeting resources.
2. Conducting criminal activities.
3. Hiding data.
4. Employee turnover.
5. The investigator.

QUESTION 15

As a forensic investigator, you need to create a process to:

1. Ensure being home by dinnertime.
2. Ensure the accused is guilty.
3. Minimize paperwork.
4. Conduct an efficient investigation.
5. Satisfy statutory requirements.