Practice Library
All MCQs
Browse exam-wise, subject-wise, and country-wise MCQs with explanations.
Choose an option to check your answer.
A.
It helps make the investigation more reliable, controlled, and defensible.
B.
It allows the examiner to ignore chain of custody.
C.
It removes the need for legal authority.
D.
It guarantees that all suspects are guilty.
Show Answer
Correct Answer: A. It helps make the investigation more reliable, controlled, and defensible.
Explanation:
Case documentation supports reliable forensic practice by improving control, accuracy, or defensibility.
Choose an option to check your answer.
A.
Recording actions, observations, tools, times, and findings during an investigation.
B.
Changing original evidence to make it easier to read.
C.
Deleting irrelevant data before documentation.
D.
Replacing legal authorization with technical skill.
Show Answer
Correct Answer: A. Recording actions, observations, tools, times, and findings during an investigation.
Explanation:
Case documentation means recording actions, observations, tools, times, and findings during an investigation, and it must be handled with proper documentation and evidence integrity.
Choose an option to check your answer.
A.
It helps make the investigation more reliable, controlled, and defensible.
B.
It allows the examiner to ignore chain of custody.
C.
It removes the need for legal authority.
D.
It guarantees that all suspects are guilty.
Show Answer
Correct Answer: A. It helps make the investigation more reliable, controlled, and defensible.
Explanation:
Evidence acquisition plan supports reliable forensic practice by improving control, accuracy, or defensibility.
Choose an option to check your answer.
A.
Deciding what evidence to collect, in what order, and by which method.
B.
Changing original evidence to make it easier to read.
C.
Deleting irrelevant data before documentation.
D.
Replacing legal authorization with technical skill.
Show Answer
Correct Answer: A. Deciding what evidence to collect, in what order, and by which method.
Explanation:
Evidence acquisition plan means deciding what evidence to collect, in what order, and by which method, and it must be handled with proper documentation and evidence integrity.
Choose an option to check your answer.
A.
It helps make the investigation more reliable, controlled, and defensible.
B.
It allows the examiner to ignore chain of custody.
C.
It removes the need for legal authority.
D.
It guarantees that all suspects are guilty.
Show Answer
Correct Answer: A. It helps make the investigation more reliable, controlled, and defensible.
Explanation:
Forensic triage supports reliable forensic practice by improving control, accuracy, or defensibility.
Choose an option to check your answer.
A.
Quickly prioritizing devices or evidence sources for deeper analysis.
B.
Changing original evidence to make it easier to read.
C.
Deleting irrelevant data before documentation.
D.
Replacing legal authorization with technical skill.
Show Answer
Correct Answer: A. Quickly prioritizing devices or evidence sources for deeper analysis.
Explanation:
Forensic triage means quickly prioritizing devices or evidence sources for deeper analysis, and it must be handled with proper documentation and evidence integrity.
Choose an option to check your answer.
A.
Analysis
B.
Packaging only
C.
Advertising
D.
Formatting
Show Answer
Correct Answer: A. Analysis
Explanation:
Analysis interprets evidence in relation to investigative questions.
Choose an option to check your answer.
A.
Evidence management
B.
Data wiping
C.
Wireless scanning
D.
Code compilation
Show Answer
Correct Answer: A. Evidence management
Explanation:
Labels help track and manage evidence.
Choose an option to check your answer.
A.
Anti-forensic activity and alternate evidence sources
B.
Automatic case closure
C.
Evidence is useless always
D.
No reporting needed
Show Answer
Correct Answer: A. Anti-forensic activity and alternate evidence sources
Explanation:
Log deletion may be anti-forensic; other sources may still help.
Choose an option to check your answer.
A.
Dynamic analysis
B.
Hash-only analysis
C.
Paper analysis
D.
Legal review only
Show Answer
Correct Answer: A. Dynamic analysis
Explanation:
Dynamic analysis observes behavior during execution.
Choose an option to check your answer.
A.
Static analysis
B.
Dynamic analysis
C.
Social analysis
D.
Physical access control
Show Answer
Correct Answer: A. Static analysis
Explanation:
Static analysis examines files without execution.
Choose an option to check your answer.
A.
To ensure useful evidence is available later
B.
To hide attacks
C.
To increase file size only
D.
To avoid compliance
Show Answer
Correct Answer: A. To ensure useful evidence is available later
Explanation:
Retention policies support forensic readiness.
