ACE Risk Management & Mitigation 3

Question 1

A forensic examiner is called to respond to a ransomware incident. Which immediate action best mitigates further data loss risk?

Accepted Answer

Isolate affected systems from the network to prevent spread

Answer

Network isolation prevents ransomware from propagating to additional systems while preserving the existing state for forensic analysis.

Question 2

Which framework is most commonly referenced for IT risk management and aligns closely with digital forensics operational risk controls?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 provides a comprehensive guide to risk assessment that is widely applied to IT and digital forensics environments.

Question 3

An examiner's workstation is compromised by malware mid-investigation. Which risk was insufficiently mitigated?

Accepted Answer

Examiner workstation integrity risk

Answer

Malware on the examiner's workstation represents a failure to mitigate workstation integrity risk, which can contaminate forensic analysis results.

Question 4

A risk assessment reveals that the probability of unauthorized physical access to evidence storage is 'high' but the impact is 'low.' How should this risk typically be prioritized?

Accepted Answer

Treat as medium priority and schedule remediation

Answer

High probability combined with low impact generally yields a medium overall risk rating, warranting planned remediation rather than immediate action.

Question 5

Which of the following best describes a 'threat' in the context of risk management for a forensic lab?

Accepted Answer

A potential cause of an unwanted incident that could harm assets

Answer

A threat is any potential cause of an unwanted incident, such as a malicious actor, natural disaster, or human error, that could exploit vulnerabilities.

(ACE) AccessData Certified Examiner Practice Test

(ACE) AccessData Certified Examiner Practice Test

ACE Risk Management & Mitigation 3