ACI Communication & Stakeholder Engagement 2 — Questions and Answers
Question 1: During a digital forensic investigation, a business unit manager demands a daily verbal briefing on case progress. How should the investigator handle this request?
- Comply fully and share all technical findings verbally each day
- Politely decline, explaining that verbal briefings compromise case integrity
- Establish a structured reporting cadence that shares appropriate information without jeopardizing the investigation (Correct answer)
- Redirect all communication through legal counsel only
Correct answer: Establish a structured reporting cadence that shares appropriate information without jeopardizing the investigation
Investigators should balance stakeholder needs with case integrity by providing structured, appropriate updates rather than unrestricted access to all findings.
Question 2: Which element is most critical when drafting an executive summary for non-technical leadership after a forensic investigation?
- Detailed hash values and technical tool outputs
- Clear business impact, key findings, and recommended actions in plain language (Correct answer)
- A full chain-of-custody log for all evidence
- Specific registry key paths and file timestamps
Correct answer: Clear business impact, key findings, and recommended actions in plain language
Executive summaries for non-technical audiences must convey business impact and actionable recommendations without jargon.
Question 3: An ACI investigator discovers that a suspect is also the primary point of contact managing the investigation on behalf of HR. What is the best course of action?
- Continue working with the suspect to avoid tipping them off
- Immediately close the investigation and report externally
- Escalate to senior management or legal to reassign the stakeholder role (Correct answer)
- Remove the suspect from the investigation but continue briefing them indirectly
Correct answer: Escalate to senior management or legal to reassign the stakeholder role
A conflict of interest must be escalated so an untainted stakeholder can manage communications and oversight.
Question 4: When coordinating with law enforcement during a corporate digital investigation, the investigator should:
- Share all internal evidence immediately to expedite prosecution
- Follow legal counsel's guidance on what evidence and information to provide (Correct answer)
- Withhold all information until the internal investigation is complete
- Allow law enforcement to take custody of all systems immediately
Correct answer: Follow legal counsel's guidance on what evidence and information to provide
Legal counsel should guide the scope and timing of evidence sharing with law enforcement to protect both investigative integrity and corporate interests.
Question 5: A stakeholder requests that a specific finding be excluded from the final forensic report for business reasons. The investigator should:
- Omit the finding to maintain the business relationship
- Include the finding and document the request to omit it (Correct answer)
- Ask the stakeholder to sign a waiver before omitting
- Rewrite the finding using ambiguous language
Correct answer: Include the finding and document the request to omit it
Investigators must document requests to alter reports and include all material findings to maintain professional and legal integrity.
Question 6: What is the primary purpose of a closing briefing with stakeholders at the end of a forensic investigation?
- To hand over all raw forensic images to management
- To review findings, remediation steps, and lessons learned with relevant parties (Correct answer)
- To obtain signatures releasing the investigator from liability
- To delete working copies of evidence from investigator workstations
Correct answer: To review findings, remediation steps, and lessons learned with relevant parties
A closing briefing ensures stakeholders understand findings, agree on remediation, and capture lessons learned for future prevention.
Question 7: During an investigation, a department head outside the need-to-know circle asks the investigator directly about case status. The best response is to:
- Share a high-level summary to maintain goodwill
- Confirm the investigation exists but direct them to the designated case contact (Correct answer)
- Deny that any investigation is occurring
- Provide the full report under confidentiality agreement
Correct answer: Confirm the investigation exists but direct them to the designated case contact
Investigators should neither confirm full details nor deny the investigation to unauthorized parties — they should redirect to the designated case contact.
ACI Communication & Stakeholder Engagement 2
During a digital forensic investigation, a business unit manager demands a daily verbal briefing on case progress.
How should the investigator handle this request?