ACE Risk Management & Mitigation 2 — Questions and Answers
Question 1: During a forensic investigation, an examiner discovers that a suspect encrypted files using BitLocker. Which risk mitigation approach should be prioritized to access the data?
- Brute-force the BitLocker password immediately
- Seek the recovery key from Active Directory or Microsoft account
- Reformat the drive to bypass encryption
- Run a live memory acquisition to capture the decryption key (Correct answer)
Correct answer: Run a live memory acquisition to capture the decryption key
Live memory acquisition can capture the BitLocker decryption key if the system is still running, providing the most direct access to encrypted data.
Question 2: An organization's risk register identifies 'chain of custody failure' as a high-probability risk. Which control best mitigates this?
- Encrypt all evidence at rest
- Implement a standardized evidence tracking log signed at each transfer (Correct answer)
- Store all evidence on a single secure server
- Use write blockers on all drives
Correct answer: Implement a standardized evidence tracking log signed at each transfer
A standardized evidence tracking log with signatures at each transfer directly addresses chain of custody integrity by creating an auditable record.
Question 3: A quantitative risk assessment assigns a Single Loss Expectancy (SLE) of $50,000 and an Annualized Rate of Occurrence (ARO) of 0.4. What is the Annualized Loss Expectancy (ALE)?
- $125,000
- $20,000 (Correct answer)
- $50,400
- $200,000
Correct answer: $20,000
ALE = SLE × ARO = $50,000 × 0.4 = $20,000, representing the expected annual cost of the risk.
Question 4: A forensic lab is assessing the risk of examiner error corrupting digital evidence. Which mitigation technique directly reduces this risk?
- Purchasing additional storage hardware
- Implementing peer review and dual-examiner verification procedures (Correct answer)
- Restricting internet access in the lab
- Increasing the number of case files per examiner
Correct answer: Implementing peer review and dual-examiner verification procedures
Peer review and dual-examiner verification catch errors before they affect evidence integrity, directly reducing the risk of examiner mistakes.
Question 5: Which risk treatment option involves purchasing cyber liability insurance to cover potential data breach costs?
- Risk avoidance
- Risk acceptance
- Risk transference (Correct answer)
- Risk reduction
Correct answer: Risk transference
Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider.
Question 6: An ACE examiner must assess the risk of tampering with a forensic image during network transmission. Which control best addresses this?
- Compressing the image before transfer
- Verifying MD5/SHA hash values before and after transmission (Correct answer)
- Using a faster network connection
- Splitting the image into multiple parts
Correct answer: Verifying MD5/SHA hash values before and after transmission
Comparing hash values before and after transmission confirms that the forensic image has not been altered or corrupted in transit.
Question 7: In risk management, the term 'residual risk' refers to:
- The risk that remains after all controls have been applied (Correct answer)
- The initial risk before any mitigation
- The risk transferred to an insurer
- The risk accepted without any controls
Correct answer: The risk that remains after all controls have been applied
Residual risk is the level of risk that remains after security controls and mitigation measures have been implemented.
ACE Risk Management & Mitigation 2
During a forensic investigation, an examiner discovers that a suspect encrypted files using BitLocker.
Which risk mitigation approach should be prioritized to access the data?