MCQ Collection
Pakistan MCQs
Practice Pakistan questions with answers and explanations.
Choose an option to check your answer.
A.
Running processes and active network connections
B.
Printed receipts only
C.
Cable labels only
D.
Monitor serial only
Show Answer
Correct Answer: A. Running processes and active network connections
Explanation:
RAM can contain volatile runtime artifacts.
Choose an option to check your answer.
A.
Anti-forensic activity and alternate evidence sources
B.
Automatic case closure
C.
Evidence is useless always
D.
No reporting needed
Show Answer
Correct Answer: A. Anti-forensic activity and alternate evidence sources
Explanation:
Log deletion may be anti-forensic; other sources may still help.
Choose an option to check your answer.
A.
Standard operating procedure
B.
Random process
C.
Anti-forensic script
D.
User preference
Show Answer
Correct Answer: A. Standard operating procedure
Explanation:
SOPs support consistency and defensibility.
Choose an option to check your answer.
A.
Known files or altered files
B.
Court judge identity
C.
Network cable type
D.
Monitor brightness
Show Answer
Correct Answer: A. Known files or altered files
Explanation:
Hash comparison can identify known files or integrity differences.
Choose an option to check your answer.
A.
Evidence management
B.
Data wiping
C.
Wireless scanning
D.
Code compilation
Show Answer
Correct Answer: A. Evidence management
Explanation:
Labels help track and manage evidence.
Choose an option to check your answer.
A.
Communication endpoints
B.
Hard disk serial only
C.
Monitor size
D.
Printed signature
Show Answer
Correct Answer: A. Communication endpoints
Explanation:
Network metadata can identify endpoints involved in communication.
Choose an option to check your answer.
A.
Incomplete acquisition
B.
Better reliability
C.
Increased integrity
D.
Automatic admissibility
Show Answer
Correct Answer: A. Incomplete acquisition
Explanation:
A forensic acquisition should capture relevant storage areas completely.
Choose an option to check your answer.
A.
Analysis
B.
Packaging only
C.
Advertising
D.
Formatting
Show Answer
Correct Answer: A. Analysis
Explanation:
Analysis interprets evidence in relation to investigative questions.
Choose an option to check your answer.
A.
State limitations clearly
B.
Hide limitations
C.
Invent missing evidence
D.
Modify logs
Show Answer
Correct Answer: A. State limitations clearly
Explanation:
Professional reports should include limitations and confidence boundaries.
Choose an option to check your answer.
A.
To make findings understandable and defensible
B.
To confuse readers
C.
To avoid accountability
D.
To replace evidence
Show Answer
Correct Answer: A. To make findings understandable and defensible
Explanation:
A complete report supports review and decision-making.
Choose an option to check your answer.
A.
Quickly prioritizing devices or evidence sources for deeper analysis.
B.
Changing original evidence to make it easier to read.
C.
Deleting irrelevant data before documentation.
D.
Replacing legal authorization with technical skill.
Show Answer
Correct Answer: A. Quickly prioritizing devices or evidence sources for deeper analysis.
Explanation:
Forensic triage means quickly prioritizing devices or evidence sources for deeper analysis, and it must be handled with proper documentation and evidence integrity.
Choose an option to check your answer.
A.
Deleted content may remain until overwritten
B.
Deleted files always vanish instantly
C.
RAM stores all deleted files permanently
D.
File recovery is illegal always
Show Answer
Correct Answer: A. Deleted content may remain until overwritten
Explanation:
Unallocated space may contain remnants of deleted files.
