MCQ Collection
Pakistan MCQs
Practice Pakistan questions with answers and explanations.
Choose an option to check your answer.
A.
Cross-source event correlation
B.
Evidence deletion
C.
Tool replacement
D.
File compression
Show Answer
Correct Answer: A. Cross-source event correlation
Explanation:
Multiple sources help reconstruct events more reliably.
Choose an option to check your answer.
A.
Recording actions, observations, tools, times, and findings during an investigation.
B.
Changing original evidence to make it easier to read.
C.
Deleting irrelevant data before documentation.
D.
Replacing legal authorization with technical skill.
Show Answer
Correct Answer: A. Recording actions, observations, tools, times, and findings during an investigation.
Explanation:
Case documentation means recording actions, observations, tools, times, and findings during an investigation, and it must be handled with proper documentation and evidence integrity.
Choose an option to check your answer.
A.
Possible location where the photo was taken
B.
Guaranteed identity of photographer
C.
Disk size
D.
Network speed
Show Answer
Correct Answer: A. Possible location where the photo was taken
Explanation:
GPS metadata may suggest location but must be validated.
Choose an option to check your answer.
A.
Correlate artifacts and report findings objectively
B.
Declare guilt immediately
C.
Delete conflicting artifacts
D.
Ignore metadata
Show Answer
Correct Answer: A. Correlate artifacts and report findings objectively
Explanation:
Forensic conclusions should rely on correlated evidence and objective reporting.
Choose an option to check your answer.
A.
To prevent remote communication or wiping
B.
To charge the battery
C.
To improve camera quality
D.
To delete files
Show Answer
Correct Answer: A. To prevent remote communication or wiping
Explanation:
Isolation can prevent remote access or wiping.
Choose an option to check your answer.
A.
It helps make the investigation more reliable, controlled, and defensible.
B.
It allows the examiner to ignore chain of custody.
C.
It removes the need for legal authority.
D.
It guarantees that all suspects are guilty.
Show Answer
Correct Answer: A. It helps make the investigation more reliable, controlled, and defensible.
Explanation:
Case documentation supports reliable forensic practice by improving control, accuracy, or defensibility.
Choose an option to check your answer.
A.
Digital forensic readiness
B.
Data wiping
C.
Format string bug
D.
Packet spoofing
Show Answer
Correct Answer: A. Digital forensic readiness
Explanation:
Readiness prepares the organization for future investigations.
Choose an option to check your answer.
A.
Loss of evidence control and credibility
B.
Better legal admissibility
C.
Automatic validation
D.
Faster court approval
Show Answer
Correct Answer: A. Loss of evidence control and credibility
Explanation:
Poor labeling damages evidence management.
Choose an option to check your answer.
A.
A documented live response procedure
B.
Uncontrolled shutdown
C.
Random deletion
D.
Silent evidence editing
Show Answer
Correct Answer: A. A documented live response procedure
Explanation:
Live response should be planned and documented.
Choose an option to check your answer.
A.
To reduce risk to production systems
B.
To infect the whole network
C.
To bypass all laws
D.
To destroy evidence
Show Answer
Correct Answer: A. To reduce risk to production systems
Explanation:
Isolation helps safely observe suspicious behavior.
Choose an option to check your answer.
A.
Regulatory compliance
B.
Disk defragmentation
C.
Screen capture
D.
File carving
Show Answer
Correct Answer: A. Regulatory compliance
Explanation:
Breach notification is a compliance matter.
Choose an option to check your answer.
A.
File system metadata and recovered remnants
B.
Monitor size only
C.
Keyboard brand only
D.
Cable color only
Show Answer
Correct Answer: A. File system metadata and recovered remnants
Explanation:
Metadata and remnants can support file existence.
