ACE Industry Regulations & Compliance 5

Question 1

Which provision of the USA PATRIOT Act most directly expanded law enforcement's ability to conduct surveillance and obtain records relevant to digital forensic investigations?

Accepted Answer

Section 215 — business records and tangible things

Answer

Section 702 — foreign intelligence collection

Answer

Section 312 — special due diligence for correspondent accounts

Answer

Section 505 — National Security Letters

Question 2

When an ACE-certified examiner testifies as an expert witness, Federal Rule of Evidence 702 requires that expert testimony be based on sufficient facts and that the methodology be:

Accepted Answer

The product of reliable principles reliably applied to the facts

Answer

Approved by a federal agency prior to trial

Answer

Peer-reviewed in at least two forensic journals

Answer

Validated by at least three independent forensic laboratories

Question 3

Under ISO/IEC 27037:2012, what is the correct sequence of actions when handling digital evidence at a scene?

Accepted Answer

Identify, collect, acquire, preserve

Answer

Analyze, identify, collect, preserve

Answer

Preserve, identify, collect, analyze

Answer

Collect, identify, preserve, acquire

Question 4

Which U.S. regulation requires financial institutions to file a Suspicious Activity Report (SAR) within 30 days of detecting a transaction that may involve money laundering, and is relevant when forensic findings reveal illicit financial flows?

Accepted Answer

Bank Secrecy Act (BSA) / FinCEN regulations

Answer

Dodd-Frank Act

Answer

Sarbanes-Oxley Act

Answer

Fair Credit Reporting Act

Question 5

A forensic examiner in a state with mandatory data breach notification laws discovers a breach involving Social Security numbers. In most U.S. states, the notification obligation is typically triggered when:

Accepted Answer

Unauthorized acquisition of unencrypted personal information is reasonably believed to have occurred

Answer

The breach is confirmed by a third-party auditor

Answer

The organization's cyber insurance carrier approves the notification

Answer

More than 500 individuals are affected

Question 6

Under the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, what must a defense contractor do within 72 hours of discovering a cyber incident affecting covered defense information (CDI)?

Accepted Answer

Report the incident to the DoD via the DIBNet portal

Answer

Patch all affected systems and submit remediation proof to NIST

Answer

Notify all subcontractors and halt work until cleared

Answer

File a criminal complaint with the FBI Cyber Division

Question 7

When a forensic investigation reveals evidence of a crime during a civil case (e.g., child exploitation material found during a corporate HR investigation), what is the examiner's primary legal and ethical obligation?

Accepted Answer

Immediately stop the examination and report to law enforcement per mandatory reporting laws

Answer

Continue the civil examination and report findings only to the client attorney

Answer

Quarantine the evidence and await further legal instructions from the client

Answer

Complete the full forensic image before reporting to avoid evidence spoliation claims