MCQ Collection
Pakistan MCQs
Practice Pakistan questions with answers and explanations.
Choose an option to check your answer.
Correct Answer: A. To support network evidence collection during an investigation.
Explanation:
The purpose of packet capture is connected with network evidence collection, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling live acquisition.
Choose an option to check your answer.
Correct Answer: A. Data describing other data, such as timestamps, author, and file properties.
Explanation:
Metadata refers to data describing other data, such as timestamps, author, and file properties.
Choose an option to check your answer.
Correct Answer: A. To support potential evidence area during an investigation.
Explanation:
The purpose of unallocated space is connected with potential evidence area, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling packet capture.
Choose an option to check your answer.
Correct Answer: A. Collecting evidence from a powered-off system or storage device.
Explanation:
Dead acquisition refers to collecting evidence from a powered-off system or storage device.
Choose an option to check your answer.
Correct Answer: A. To support data about data during an investigation.
Explanation:
The purpose of metadata is connected with data about data, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling unallocated space.
Choose an option to check your answer.
Correct Answer: A. Monitoring packets to understand communications during an investigation.
Explanation:
Packet sniffing in forensics refers to monitoring packets to understand communications during an investigation.
Choose an option to check your answer.
Correct Answer: A. To support offline evidence collection during an investigation.
Explanation:
The purpose of dead acquisition is connected with offline evidence collection, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling metadata.
Choose an option to check your answer.
Correct Answer: A. Examining structures such as directories, allocation tables, and timestamps.
Explanation:
File system analysis refers to examining structures such as directories, allocation tables, and timestamps.
