Digital Forensics (Module 3 Post Test)
Which of the following is NOT a characteristic expected or required of an expert witness? Correct
Answer: Charisma.
Discovery is best described as the ________. Correct Answer: Discovery
The purpose and goal of a written forensic report is to present the evidence in a report that is ________.
Correct Answer: Beyond challenge or criticism in court.
Evidence is only unbiased or objective when ________. Correct Answer: The evidence points to an
absolute truth. (?)
What is the goal of a written forensic report provided by a digital forensic expert? Correct Answer:
Provide answers to the legal system regarding questions on digital topics.
Post-mortem sessions are short meetings best held with ________ and forensic professionals to
improve the quality of answers to questions asked. Correct Answer: The attorney who hired the forensic
professional. (?)
What is the purpose of an attorney's examination of an expert witness? Correct Answer: To support
his/her theory of events while excluding other theories.
A digital forensic expert who is "sworn in" is an expert who ________. Correct Answer: A digital forensic
expert who is "sworn in" is an expert who ________.
Which section of the forensic report would document the procedures and technologies used to collect
and analyze the evidence? Correct Answer: Relevant Findings.
A court "record" documents ________ of expert witnesses. Correct Answer: All of the above.
Which of the following is best described with the statement, "A report on digital forensics is presented
by testimony to a judge and jury"? Correct Answer: Formal report.
The Daubert standard is the standard by which a court will approve ________. Correct Answer: New
technologies.
The aim of an attorney who "attacks the theory" of the opposing attorney is to ________. Correct
Answer: a. Disprove the evidence that supports the theory.
b. Introduce reasonable doubt.
c. Disprove the opposing attorney's theory.
The details of an incident in which an intrusion has been detected will be reported to ________ for
further investigation if necessary. Correct Answer: Both the forensic investigation and intrusion
response teams.
Which of the following is NOT a characteristic expected or required of an expert witness? Correct
Answer: Charisma.
Discovery is best described as the ________. Correct Answer: Discovery
The purpose and goal of a written forensic report is to present the evidence in a report that is ________.
Correct Answer: Beyond challenge or criticism in court.
Evidence is only unbiased or objective when ________. Correct Answer: The evidence points to an
absolute truth. (?)
What is the goal of a written forensic report provided by a digital forensic expert? Correct Answer:
Provide answers to the legal system regarding questions on digital topics.
Post-mortem sessions are short meetings best held with ________ and forensic professionals to
improve the quality of answers to questions asked. Correct Answer: The attorney who hired the forensic
professional. (?)
What is the purpose of an attorney's examination of an expert witness? Correct Answer: To support
his/her theory of events while excluding other theories.
A digital forensic expert who is "sworn in" is an expert who ________. Correct Answer: A digital forensic
expert who is "sworn in" is an expert who ________.
Which section of the forensic report would document the procedures and technologies used to collect
and analyze the evidence? Correct Answer: Relevant Findings.
A court "record" documents ________ of expert witnesses. Correct Answer: All of the above.
Which of the following is best described with the statement, "A report on digital forensics is presented
by testimony to a judge and jury"? Correct Answer: Formal report.
The Daubert standard is the standard by which a court will approve ________. Correct Answer: New
technologies.
The aim of an attorney who "attacks the theory" of the opposing attorney is to ________. Correct
Answer: a. Disprove the evidence that supports the theory.
b. Introduce reasonable doubt.
c. Disprove the opposing attorney's theory.
The details of an incident in which an intrusion has been detected will be reported to ________ for
further investigation if necessary. Correct Answer: Both the forensic investigation and intrusion
response teams.
