MCQ Collection
Semester Exam MCQs
Semester Exam preparation MCQs for university and college students. This section includes subject-wise practice questions, answers, and explanations to help learners prepare for midterm exams, final exams, quizzes, and academic tests.
Choose an option to check your answer.
A.
Document the process and preserve evidence integrity.
B.
Modify original evidence to make analysis easier.
C.
Ignore chain of custody because the case is technical.
D.
Delete unrelated files from the original device.
Show Answer
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling embedded device forensics.
Choose an option to check your answer.
A.
A forensic expert focuses on evidence handling, legal process, and investigative soundness.
B.
Same role always.
C.
Marketing role.
D.
Hardware sales.
Show Answer
Correct Answer: A. A forensic expert focuses on evidence handling, legal process, and investigative soundness.
Explanation:
Computer expert vs forensic expert refers to a forensic expert focuses on evidence handling, legal process, and investigative soundness.
Choose an option to check your answer.
A.
To prove the image matches the original
B.
To increase storage capacity
C.
To remove malware automatically
D.
To compress all files
Show Answer
Correct Answer: A. To prove the image matches the original
Explanation:
Matching hashes support integrity of forensic copies.
Choose an option to check your answer.
A.
Examining ram dumps for running processes, network connections, and volatile artifacts.
B.
Paper filing.
C.
Disk labeling.
D.
Visual styling.
Show Answer
Correct Answer: A. Examining ram dumps for running processes, network connections, and volatile artifacts.
Explanation:
Memory forensics refers to examining RAM dumps for running processes, network connections, and volatile artifacts.
Choose an option to check your answer.
A.
To support role distinction during an investigation.
B.
To perform same role always without authorization.
C.
To replace all legal documentation.
D.
To avoid evidence documentation.
Show Answer
Correct Answer: A. To support role distinction during an investigation.
Explanation:
The purpose of computer expert vs forensic expert is connected with role distinction, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
A.
Use a write blocker before imaging
B.
Open and edit files directly
C.
Install tools on the USB drive
D.
Delete irrelevant folders
Show Answer
Correct Answer: A. Use a write blocker before imaging
Explanation:
A write blocker prevents accidental modification of the source media.
Choose an option to check your answer.
A.
To support RAM evidence analysis during an investigation.
B.
To perform paper filing without authorization.
C.
To replace all legal documentation.
D.
To avoid evidence documentation.
Show Answer
Correct Answer: A. To support RAM evidence analysis during an investigation.
Explanation:
The purpose of memory forensics is connected with RAM evidence analysis, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
A.
Document the process and preserve evidence integrity.
B.
Modify original evidence to make analysis easier.
C.
Ignore chain of custody because the case is technical.
D.
Delete unrelated files from the original device.
Show Answer
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling computer expert vs forensic expert.
Choose an option to check your answer.
A.
Use clear language and explain technical terms
B.
Include only raw hex values
C.
Hide limitations
D.
Avoid conclusions completely
Show Answer
Correct Answer: A. Use clear language and explain technical terms
Explanation:
Forensic reports should match the audience while remaining accurate.
Choose an option to check your answer.
A.
Document the process and preserve evidence integrity.
B.
Modify original evidence to make analysis easier.
C.
Ignore chain of custody because the case is technical.
D.
Delete unrelated files from the original device.
Show Answer
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling memory forensics.
Choose an option to check your answer.
A.
Training personnel to recognize evidence, legal duties, and proper response.
B.
Evidence hiding.
C.
Data wiping.
D.
Password sharing.
Show Answer
Correct Answer: A. Training personnel to recognize evidence, legal duties, and proper response.
Explanation:
Education and awareness refers to training personnel to recognize evidence, legal duties, and proper response.
Choose an option to check your answer.
A.
Legal authority and cross-border compliance
B.
Screen resolution
C.
Keyboard layout
D.
File icon color
Show Answer
Correct Answer: A. Legal authority and cross-border compliance
Explanation:
Cloud investigations often involve jurisdiction and compliance concerns.
