Practice Library
All MCQs
Browse exam-wise, subject-wise, and country-wise MCQs with explanations.
Choose an option to check your answer.
Correct Answer: A. Volatile data such as RAM and active network connections
Explanation:
Live volatile evidence may disappear after shutdown.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling embedded device forensics.
Choose an option to check your answer.
Correct Answer: A. A forensic expert focuses on evidence handling, legal process, and investigative soundness.
Explanation:
Computer expert vs forensic expert refers to a forensic expert focuses on evidence handling, legal process, and investigative soundness.
Choose an option to check your answer.
Correct Answer: A. To prove the image matches the original
Explanation:
Matching hashes support integrity of forensic copies.
Choose an option to check your answer.
Correct Answer: A. Examining ram dumps for running processes, network connections, and volatile artifacts.
Explanation:
Memory forensics refers to examining RAM dumps for running processes, network connections, and volatile artifacts.
Choose an option to check your answer.
Correct Answer: A. To support role distinction during an investigation.
Explanation:
The purpose of computer expert vs forensic expert is connected with role distinction, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Use a write blocker before imaging
Explanation:
A write blocker prevents accidental modification of the source media.
Choose an option to check your answer.
Correct Answer: A. To support RAM evidence analysis during an investigation.
Explanation:
The purpose of memory forensics is connected with RAM evidence analysis, not with altering or avoiding evidence procedures.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling computer expert vs forensic expert.
Choose an option to check your answer.
Correct Answer: A. Use clear language and explain technical terms
Explanation:
Forensic reports should match the audience while remaining accurate.
Choose an option to check your answer.
Correct Answer: A. Document the process and preserve evidence integrity.
Explanation:
Forensic work requires documentation and preservation of evidence integrity, especially when handling memory forensics.
Choose an option to check your answer.
Correct Answer: A. Training personnel to recognize evidence, legal duties, and proper response.
Explanation:
Education and awareness refers to training personnel to recognize evidence, legal duties, and proper response.
