Title: Module 5 Quiz
Course: CAP 2140 Digital Forensics > Section: Processing Crime and Incident Scenes

Q: ____ records are data the system maintains, such as system log files and proxy server logs.
- Computer-generated
- Business
- Computer-stored
- Hearsay
A: Computer-generated

Q: The FOIA was originally enacted in the ____.
- 1940s
- 1950s
- 1960s
- 1970s
A: 1960s

Q: Have you read the syllabus completely and thoroughly?
- Yes
- No
A: Yes

Q: Investigating and controlling computer incident scenes in the corporate environment is ____ in the criminal environment.
- much easier than
- as easy as
- as difficult as
- more difficult than
A: much easier than

Q: Do you accept all the items in the syllabus?
- Yes
- No
A: Yes

Q: Every business or organization must have a well defined process that describes when an investigation can be initiated. At a minimum, most corporate policies require that employers have a ____ that a law or policy is being violated.
- confirmed suspicion
- proof
- court order stating
- reasonable suspicion
A: reasonable suspicion

Q: Confidential business data included with the criminal evidence are referred to as ____ data.
- commingled
- exposed
- public
- revealed
A: commingled

Q: ____ is facts or circumstances that would lead a reasonable person to believe a crime has been committed or is about to be committed.
- Reasonable cause
- Probable cause
- A subpoena
- A warrant
A: Probable cause

Q: Law enforcement investigators need a(n) ____ to remove computers from a crime scene and transport them to a lab.
- evidence custody form
- FOIA form
- affidavit
- warrant
A: warrant

Q: Environmental and ____ issues are your primary concerns when you’re working at the scene to gather information about an incident or a crime.
- legal
- safety
- corporate
- physical
A: safety

Q: Most federal courts have interpreted computer records as ____ evidence.
- conclusive
- regular
- hearsay
- direct
A: hearsay

Q: Generally, computer records are considered admissible if they qualify as a ____ record.
- hearsay
- business
- computer-generated
- computer-stored
A: business

Q: Real-time surveillance requires ____ data transmissions between a suspect’s computer and a network server.
- poisoning
- sniffing
- blocking
- preventing
A: sniffing

Q: One technique for extracting evidence from large systems is called ____.
- RAID copy
- RAID imaging
- large evidence file recovery
- sparse acquisition
A: sparse acquisition

Q: _____________________ can be any information stored or transmitted in digital form.
A: Digital evidence

Q: If a company does not publish a policy stating that it reserves the right to inspect computing assets at will or display a warning banner, employees have a(n) _________________________.
A: expectation of privacy

Q: Private-sector organizations include businesses and _________________________ that aren’t involved in law enforcement.
A: government agencies

Q: Some computer cases involve dangerous settings. For these types of investigations, you must rely on the skills of _________________________ teams to recover evidence from the scene.
A: hazardous materials (HAZMAT) / hazardous materials / HAZMAT / HAZMAT (hazardous materials)

Q: What should you do when working on an Internet investigation and the suspect’s computer is on?

Q: Give some guidelines on how to video record a computer incident or crime scene.