Question 1

A cybercriminal hacked into an Apple iPad that belongs to a company's chief executive officer (CEO). The cybercriminal deleted some important files on the data volume that must be retrieved. Which hidden folder will contain the digital evidence?

Options :

A : /Private/etc

B : /lost+found

C : /.Trashes/501

D : /etc

Answer: C

Question 2

How should a forensic scientist obtain the network configuration from a Windows PC before seizing it from a crime scene?

Options :

A : By checking the system properties

B : By using the ipconfig command from a command prompt on the computer

C : By opening the Network and Sharing Center

D : By rebooting the computer into safe mode

Answer: B

Question 3

An organization believes that a company-owned mobile phone has been compromised. Which software should be used to collect an image of the phone as digital evidence?

Options :

A : PTFinder

B : Forensic SIM Cloner

C : Forensic Toolkit (FTK)

D : Data Doctor

Answer: C

Question 4

Which U.S. law criminalizes the act of knowingly using a misleading domain name with the intent to deceive a minor into viewing harmful material?

Options :

A : Communications Assistance to Law Enforcement Act (CALEA)

B : 18 U.S.C. 2252B

C : The Privacy Protection Act (PPA)

D : Electronic Communications Privacy Act (ECPA)

Answer: B

Question 5

Which principle of evidence collection states that access to evidence must be tracked from the time it is seized through its use in court?

Options :

A : Evidence record

B : Chain of custody

C : Event log

D : Audit log

Answer: B