Practice Library
All MCQs
Browse exam-wise, subject-wise, and country-wise MCQs with explanations.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling non-volatile data.
Choose an option to check your answer.
Correct Answer: A. To support persistent storage data during an investigation.
Explanation:
The purpose of non-volatile data is connected with persistent storage data, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Data that remains after power is removed, such as files on a hard drive.
Explanation:
Non-volatile data refers to data that remains after power is removed, such as files on a hard drive.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling volatile data.
Choose an option to check your answer.
Correct Answer: A. To support temporary system data during an investigation.
Explanation:
The purpose of volatile data is connected with temporary system data, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Data that may be lost when power is removed, such as ram contents.
Explanation:
Volatile data refers to data that may be lost when power is removed, such as RAM contents.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling dead acquisition.
Choose an option to check your answer.
Correct Answer: A. To support offline evidence collection during an investigation.
Explanation:
The purpose of dead acquisition is connected with offline evidence collection, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Collecting evidence from a powered-off system or storage device.
Explanation:
Dead acquisition refers to collecting evidence from a powered-off system or storage device.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling live acquisition.
Choose an option to check your answer.
Correct Answer: A. To support volatile evidence collection during an investigation.
Explanation:
The purpose of live acquisition is connected with volatile evidence collection, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Collecting volatile data from a running system before shutdown.
Explanation:
Live acquisition refers to collecting volatile data from a running system before shutdown.
