- (Topic 2)
A small law firm located in the Midwest has possibly been breached by a computer hacker looking to obtain information on their clientele. The law firm does not have any on-site IT employees, but wants to search for evidence of the breach themselves to prevent any possible media attention. Why would this not be recommended?

1. A. Searching for evidence themselves would not have any ill effects
2. B. Searching could possibly crash the machine or device
3. C. Searching creates cache files, which would hinder the investigation
4. D. Searching can change date/time stamps

Correct Answer: D

- (Topic 2)
When performing a forensics analysis, what device is used to prevent the system from recording data on an evidence disk?

1. A. Write-blocker
2. B. Protocol analyzer
3. C. Firewall
4. D. Disk editor

Correct Answer: A

- (Topic 1)
Event correlation is a procedure that is assigned with a new meaning for a set of events that occur in a predefined interval of time.
Which type of correlation will you use if your organization wants to use different OS and network hardware platforms throughout the network?

1. A. Same-platform correlation
2. B. Cross-platform correlation
3. C. Multiple-platform correlation
4. D. Network-platform correlation

Correct Answer: B

- (Topic 1)
An image is an artifact that reproduces the likeness of some subject. These are produced by optical devices (i.e. cameras, mirrors, lenses, telescopes, and microscopes).
Which property of the image shows you the number of colors available for each pixel in an image?

1. A. Pixel
2. B. Bit Depth
3. C. File Formats
4. D. Image File Size

Correct Answer: B

- (Topic 2)
What must be obtained before an investigation is carried out at a location?

1. A. Search warrant
2. B. Subpoena
3. C. Habeas corpus
4. D. Modus operandi

Correct Answer: A