ISA Digital Forensics & Investigation 3

Question 1

What is the primary legal standard for digital evidence to be admissible in a US court?

Accepted Answer

It must be relevant, authentic, and collected without alteration

Answer

It must be collected only by law enforcement

Answer

It must be stored on government-approved media

Answer

It must be analyzed using open-source tools only

Question 2

An investigator discovers that log files on a compromised server were deleted by the attacker. Which forensic technique could help recover them?

Accepted Answer

File carving from unallocated disk space

Answer

Reviewing the firewall ACLs

Answer

Checking the Windows Registry

Answer

Running a port scan against the server

Question 3

Which Windows Registry hive stores information about USB devices that have been connected to a system?

Accepted Answer

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

Answer

HKEY_LOCAL_MACHINE\SOFTWARE

Answer

HKEY_CURRENT_USER\Software\Microsoft\Windows

Answer

HKEY_LOCAL_MACHINE\SECURITY

Question 4

What is 'anti-forensics' and why is it a concern for investigators?

Accepted Answer

Techniques used to destroy, hide, or falsify digital evidence to impede investigations

Answer

A legal defense strategy against forensic findings

Answer

A method for encrypting forensic reports

Answer

A framework for auditing forensic tool accuracy

Question 5

During a forensic investigation, an analyst finds timestamps that appear inconsistent with the suspected attack timeline. What should the analyst consider?

Accepted Answer

Consider time zone differences, clock skew, and possible timestamp manipulation

Answer

Discard the timestamps as unreliable and ignore them

Answer

Assume the suspect's alibi is valid based on the timestamps

Answer

Immediately report the findings as conclusive evidence

Question 6

What is the significance of the 'prefetch' folder in Windows forensic investigations?

Accepted Answer

It contains files that record when and how frequently applications were executed

Answer

It stores temporary internet files for faster browsing

Answer

It holds Windows Update cache files

Answer

It stores user profile backup data

Question 7

Which standard framework provides guidelines for conducting digital forensic investigations?

Accepted Answer

NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response)

Answer

ISO/IEC 27001

Answer

PCI DSS v4.0

Answer

OWASP Testing Guide