MCQ Collection
Pakistan MCQs
Practice Pakistan questions with answers and explanations.
Choose an option to check your answer.
Correct Answer: A. Investigating devices such as iot systems, routers, or specialized hardware.
Explanation:
Embedded device forensics refers to investigating devices such as IoT systems, routers, or specialized hardware.
Choose an option to check your answer.
Correct Answer: A. To support analysis constraint during an investigation.
Explanation:
The purpose of tool limitation is connected with analysis constraint, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling analysis scenario.
Choose an option to check your answer.
Correct Answer: A. To support embedded evidence analysis during an investigation.
Explanation:
The purpose of embedded device forensics is connected with embedded evidence analysis, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling tool limitation.
Choose an option to check your answer.
Correct Answer: A. Volatile data such as RAM and active network connections
Explanation:
Live volatile evidence may disappear after shutdown.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling embedded device forensics.
Choose an option to check your answer.
Correct Answer: A. A forensic expert focuses on evidence handling, legal process, and investigative soundness.
Explanation:
Computer expert vs forensic expert refers to a forensic expert focuses on evidence handling, legal process, and investigative soundness.
Choose an option to check your answer.
Correct Answer: A. To prove the image matches the original
Explanation:
Matching hashes support integrity of forensic copies.
Choose an option to check your answer.
Correct Answer: A. Examining ram dumps for running processes, network connections, and volatile artifacts.
Explanation:
Memory forensics refers to examining RAM dumps for running processes, network connections, and volatile artifacts.
Choose an option to check your answer.
Correct Answer: A. To support role distinction during an investigation.
Explanation:
The purpose of computer expert vs forensic expert is connected with role distinction, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Use a write blocker before imaging
Explanation:
A write blocker prevents accidental modification of the source media.
