Loading demo links...
Showing 1–12 of 12 questions
During evidence collection, which action best protects evidential integrity?
Select an option, then click Submit answer.
Why are incident timelines built using synchronised UTC timestamps?
Select an option, then click Submit answer.
Which two UK laws most directly govern computer misuse and personal data handling during an investigation? (Choose two.)
Select all that apply, then click Submit answer.
What is the main purpose of a chain of custody record?
Select an option, then click Submit answer.
An analyst finds possible illegal material on a seized disk. What should happen first?
Select an option, then click Submit answer.
CORRECT TEXT
The evidential principle that an examiner must be able to show an unbroken record of possession is called the ______.
Answer is in the explanation below.
Why should malware samples found during an engagement be handled on isolated systems?
Select an option, then click Submit answer.
DRAG DROP
Match each incident handling activity to its correct chronological stage.
Items to match: Preserve volatile evidence, Identify affected systems, Eradicate malicious artefacts, Review lessons learned.
Answer is in the explanation below.
Which two records best support interim reporting to a client during an investigation? (Choose two.)
Select all that apply, then click Submit answer.
Attribution of an attack is difficult mainly because attackers commonly do what?
Select an option, then click Submit answer.
Which two protocols are connectionless in normal operation? (Choose two.)
Select all that apply, then click Submit answer.
DRAG DROP
Match each protocol to the transport it primarily uses.
Items to match: HTTPS web traffic, DNS name queries, SMTP mail relay, ICMP ping messages.
Answer is in the explanation below.
