2
C702 – CHFI Newest Exam with precise detailed || || || || || || || ||
solutions
Which of the following is true regarding computer forensics?
|| || || || || || || ||
A. Computer forensics deals with the process of finding evidence related to a digital crime to find
|| || || || || || || || || || || || || || || || ||
the culprits and initiate legal action against them.
|| || || || || || ||
B. Computer forensics deals with the process of finding evidence related to a digital crime to find
|| || || || || || || || || || || || || || || || ||
the culprits and avoid legal action against them.
|| || || || || || ||
C. Computer forensics deals with the process of finding evidence related to a crime to find the
|| || || || || || || || || || || || || || || || ||
culprits and initiate legal action against them.
|| || || || || ||
D. Computer forensics deals with the process of finding evidence related to a digital crime to find
|| || || || || || || || || || || || || || || || ||
the victims and prevent legal action against them. - ✔✔A. Computer forensics deals with the
|| || || || || || || || || || || || || || ||
process of finding evidence related to a digital crime to find the culprits and initiate legal action
|| || || || || || || || || || || || || || || || ||
against them. ||
Ref: Module 1, page 19
|| || || ||
Which of the following is not an objective of computer forensics?
|| || || || || || || || || ||
A. Document vulnerabilities allowing further loss of intellectual property, finances, and
|| || || || || || || || || || ||
reputation during an attack. || || ||
B. Interpret, document, and present the evidence to be admissible during prosecution.
|| || || || || || || || || || ||
C. Track and prosecute the perpetrators in a court of law.
|| || || || || || || || || ||
D. Identify, gather, and preserve the evidence of a cybercrime. - ✔✔A. Document vulnerabilities
|| || || || || || || || || || || || || ||
allowing further loss of intellectual property, finances, and reputation during an attack.
|| || || || || || || || || || ||
Ref: Module 1, page 19
|| || || ||
Forensic readiness refers to ________.|| || || ||
A. having no impact on prospects of successful legal action
|| || || || || || || || ||
B. the establishment of specific incident response procedures and designated trained personnel to
|| || || || || || || || || || || || ||
prevent a breach || ||
C. replacing the need to meet all regulatory requirements
|| || || || || || || ||
,2
D. an organization's ability to make optimal use of digital evidence in a limited time period and
|| || || || || || || || || || || || || || || || ||
with minimal investigation costs - ✔✔D. an organization's ability to make optimal use of digital
|| || || || || || || || || || || || || || ||
evidence in a limited time period and with minimal investigation costs
|| || || || || || || || || ||
Ref: Module 1, page 31
|| || || ||
What is not an impact of cybercrime?
|| || || || || ||
A. Huge financial gain
|| || ||
B. Loss of customer and stakeholder trust
|| || || || || ||
C. Substantial reputational damage
|| || ||
D. Theft of sensitive data - ✔✔A. Huge financial gain
|| || || || || || || || ||
Ref: Module 1, page 28
|| || || ||
Which of the following is true of cybercrimes?
|| || || || || || ||
A. The searching of the devices is based on mutual understanding and provides a wider time
|| || || || || || || || || || || || || || || ||
frame to hide the evidence. || || || ||
B. Investigators attempt to demonstrate information to the opposite party to support the claims
|| || || || || || || || || || || || || ||
and induce settlement.
|| ||
C. The claimant is responsible for the collection and analysis of the evidence.
|| || || || || || || || || || || ||
D. Investigators, with a warrant, have the authority to forcibly seize the computing devices. -
|| || || || || || || || || || || || || || ||
✔✔D. Investigators, with a warrant, have the authority to forcibly seize the computing devices.
|| || || || || || || || || || || || ||
Ref: Module 1, page 30
|| || || ||
Which of the following is true of civil crimes?
|| || || || || || || ||
A. A formal investigation report is required.
|| || || || || ||
B. The standards of proof need to be very high.
|| || || || || || || || ||
C. The initial reporting of the evidence is generally informal.
|| || || || || || || || ||
D. Law enforcement agencies are responsible for collecting and analyzing evidence. - ✔✔C. The
|| || || || || || || || || || || || || ||
initial reporting of the evidence is generally informal.
|| || || || || || ||
Ref: Module 1, page 31
|| || || ||
,2
Which of the following is a user-created source of potential evidence?
|| || || || || || || || || ||
A. Address book
|| ||
B. Cookies
||
C. Printer spool
|| ||
D. Log files - ✔✔A. Address book
|| || || || || ||
Ref: Module 1, page 39
|| || || ||
Which of the following is a computer-created source of potential evidence?
|| || || || || || || || || ||
A. Spreadsheet
||
B. Bookmarks
||
C. Steganography
||
D. Swap file - ✔✔D. Swap file
|| || || || || ||
Ref: Module 1, page 39
|| || || ||
Which of the following is not where potential evidence may be located?
|| || || || || || || || || || ||
A. Smart card
|| ||
B. Digital camera
|| ||
C. Thumb drive
|| ||
D. Processor - ✔✔D. Processor
|| || || ||
Ref: Module 1, pages 37-38
|| || || ||
Under which of the following conditions will duplicate evidence not suffice?
|| || || || || || || || || ||
A. When original evidence is in possession of a third party
|| || || || || || || || || ||
B. When original evidence is destroyed in the normal course of business
|| || || || || || || || || || ||
C. When original evidence is in possession of the originator
|| || || || || || || || ||
, 2
D. When original evidence is destroyed due to fire or flood - ✔✔C. When original evidence is in
|| || || || || || || || || || || || || || || || || ||
possession of the originator || || ||
Ref: Module 1, page 42
|| || || ||
Which of the following Federal Rules of Evidence contains Rulings on Evidence?
|| || || || || || || || || || ||
A. Rule 103
|| ||
B. Rule 102
|| ||
C. Rule 101
|| ||
D. Rule 105 - ✔✔A. Rule 103
|| || || || || ||
Ref: Module 1, page 46
|| || || ||
Which of the following Federal Rules of Evidence ensures that the truth may be ascertained and
|| || || || || || || || || || || || || || || ||
the proceedings justly determined?
|| || ||
A. Rule 103
|| ||
B. Rule 105
|| ||
C. Rule 102
|| ||
D. Rule 101 - ✔✔C. Rule 102
|| || || || || ||
Ref: Module 1, page 46
|| || || ||
Which of the following Federal Rules of Evidence governs proceedings in the courts of the
|| || || || || || || || || || || || || || ||
United States? ||
A. Rule 102
|| ||
B. Rule 103
|| ||
C. Rule 105
|| ||
D. Rule 101 - ✔✔D. Rule 101
|| || || || || ||
Ref: Module 1, page 45
|| || || ||
C702 – CHFI Newest Exam with precise detailed || || || || || || || ||
solutions
Which of the following is true regarding computer forensics?
|| || || || || || || ||
A. Computer forensics deals with the process of finding evidence related to a digital crime to find
|| || || || || || || || || || || || || || || || ||
the culprits and initiate legal action against them.
|| || || || || || ||
B. Computer forensics deals with the process of finding evidence related to a digital crime to find
|| || || || || || || || || || || || || || || || ||
the culprits and avoid legal action against them.
|| || || || || || ||
C. Computer forensics deals with the process of finding evidence related to a crime to find the
|| || || || || || || || || || || || || || || || ||
culprits and initiate legal action against them.
|| || || || || ||
D. Computer forensics deals with the process of finding evidence related to a digital crime to find
|| || || || || || || || || || || || || || || || ||
the victims and prevent legal action against them. - ✔✔A. Computer forensics deals with the
|| || || || || || || || || || || || || || ||
process of finding evidence related to a digital crime to find the culprits and initiate legal action
|| || || || || || || || || || || || || || || || ||
against them. ||
Ref: Module 1, page 19
|| || || ||
Which of the following is not an objective of computer forensics?
|| || || || || || || || || ||
A. Document vulnerabilities allowing further loss of intellectual property, finances, and
|| || || || || || || || || || ||
reputation during an attack. || || ||
B. Interpret, document, and present the evidence to be admissible during prosecution.
|| || || || || || || || || || ||
C. Track and prosecute the perpetrators in a court of law.
|| || || || || || || || || ||
D. Identify, gather, and preserve the evidence of a cybercrime. - ✔✔A. Document vulnerabilities
|| || || || || || || || || || || || || ||
allowing further loss of intellectual property, finances, and reputation during an attack.
|| || || || || || || || || || ||
Ref: Module 1, page 19
|| || || ||
Forensic readiness refers to ________.|| || || ||
A. having no impact on prospects of successful legal action
|| || || || || || || || ||
B. the establishment of specific incident response procedures and designated trained personnel to
|| || || || || || || || || || || || ||
prevent a breach || ||
C. replacing the need to meet all regulatory requirements
|| || || || || || || ||
,2
D. an organization's ability to make optimal use of digital evidence in a limited time period and
|| || || || || || || || || || || || || || || || ||
with minimal investigation costs - ✔✔D. an organization's ability to make optimal use of digital
|| || || || || || || || || || || || || || ||
evidence in a limited time period and with minimal investigation costs
|| || || || || || || || || ||
Ref: Module 1, page 31
|| || || ||
What is not an impact of cybercrime?
|| || || || || ||
A. Huge financial gain
|| || ||
B. Loss of customer and stakeholder trust
|| || || || || ||
C. Substantial reputational damage
|| || ||
D. Theft of sensitive data - ✔✔A. Huge financial gain
|| || || || || || || || ||
Ref: Module 1, page 28
|| || || ||
Which of the following is true of cybercrimes?
|| || || || || || ||
A. The searching of the devices is based on mutual understanding and provides a wider time
|| || || || || || || || || || || || || || || ||
frame to hide the evidence. || || || ||
B. Investigators attempt to demonstrate information to the opposite party to support the claims
|| || || || || || || || || || || || || ||
and induce settlement.
|| ||
C. The claimant is responsible for the collection and analysis of the evidence.
|| || || || || || || || || || || ||
D. Investigators, with a warrant, have the authority to forcibly seize the computing devices. -
|| || || || || || || || || || || || || || ||
✔✔D. Investigators, with a warrant, have the authority to forcibly seize the computing devices.
|| || || || || || || || || || || || ||
Ref: Module 1, page 30
|| || || ||
Which of the following is true of civil crimes?
|| || || || || || || ||
A. A formal investigation report is required.
|| || || || || ||
B. The standards of proof need to be very high.
|| || || || || || || || ||
C. The initial reporting of the evidence is generally informal.
|| || || || || || || || ||
D. Law enforcement agencies are responsible for collecting and analyzing evidence. - ✔✔C. The
|| || || || || || || || || || || || || ||
initial reporting of the evidence is generally informal.
|| || || || || || ||
Ref: Module 1, page 31
|| || || ||
,2
Which of the following is a user-created source of potential evidence?
|| || || || || || || || || ||
A. Address book
|| ||
B. Cookies
||
C. Printer spool
|| ||
D. Log files - ✔✔A. Address book
|| || || || || ||
Ref: Module 1, page 39
|| || || ||
Which of the following is a computer-created source of potential evidence?
|| || || || || || || || || ||
A. Spreadsheet
||
B. Bookmarks
||
C. Steganography
||
D. Swap file - ✔✔D. Swap file
|| || || || || ||
Ref: Module 1, page 39
|| || || ||
Which of the following is not where potential evidence may be located?
|| || || || || || || || || || ||
A. Smart card
|| ||
B. Digital camera
|| ||
C. Thumb drive
|| ||
D. Processor - ✔✔D. Processor
|| || || ||
Ref: Module 1, pages 37-38
|| || || ||
Under which of the following conditions will duplicate evidence not suffice?
|| || || || || || || || || ||
A. When original evidence is in possession of a third party
|| || || || || || || || || ||
B. When original evidence is destroyed in the normal course of business
|| || || || || || || || || || ||
C. When original evidence is in possession of the originator
|| || || || || || || || ||
, 2
D. When original evidence is destroyed due to fire or flood - ✔✔C. When original evidence is in
|| || || || || || || || || || || || || || || || || ||
possession of the originator || || ||
Ref: Module 1, page 42
|| || || ||
Which of the following Federal Rules of Evidence contains Rulings on Evidence?
|| || || || || || || || || || ||
A. Rule 103
|| ||
B. Rule 102
|| ||
C. Rule 101
|| ||
D. Rule 105 - ✔✔A. Rule 103
|| || || || || ||
Ref: Module 1, page 46
|| || || ||
Which of the following Federal Rules of Evidence ensures that the truth may be ascertained and
|| || || || || || || || || || || || || || || ||
the proceedings justly determined?
|| || ||
A. Rule 103
|| ||
B. Rule 105
|| ||
C. Rule 102
|| ||
D. Rule 101 - ✔✔C. Rule 102
|| || || || || ||
Ref: Module 1, page 46
|| || || ||
Which of the following Federal Rules of Evidence governs proceedings in the courts of the
|| || || || || || || || || || || || || || ||
United States? ||
A. Rule 102
|| ||
B. Rule 103
|| ||
C. Rule 105
|| ||
D. Rule 101 - ✔✔D. Rule 101
|| || || || || ||
Ref: Module 1, page 45
|| || || ||
