ACI Communication & Stakeholder Engagement 2

Question 1

During a digital forensic investigation, a business unit manager demands a daily verbal briefing on case progress. How should the investigator handle this request?

Accepted Answer

Establish a structured reporting cadence that shares appropriate information without jeopardizing the investigation

Answer

Comply fully and share all technical findings verbally each day

Answer

Politely decline, explaining that verbal briefings compromise case integrity

Answer

Redirect all communication through legal counsel only

Question 2

Which element is most critical when drafting an executive summary for non-technical leadership after a forensic investigation?

Accepted Answer

Clear business impact, key findings, and recommended actions in plain language

Answer

Detailed hash values and technical tool outputs

Answer

A full chain-of-custody log for all evidence

Answer

Specific registry key paths and file timestamps

Question 3

An ACI investigator discovers that a suspect is also the primary point of contact managing the investigation on behalf of HR. What is the best course of action?

Accepted Answer

Escalate to senior management or legal to reassign the stakeholder role

Answer

Continue working with the suspect to avoid tipping them off

Answer

Immediately close the investigation and report externally

Answer

Remove the suspect from the investigation but continue briefing them indirectly

Question 4

When coordinating with law enforcement during a corporate digital investigation, the investigator should:

Accepted Answer

Follow legal counsel's guidance on what evidence and information to provide

Answer

Share all internal evidence immediately to expedite prosecution

Answer

Withhold all information until the internal investigation is complete

Answer

Allow law enforcement to take custody of all systems immediately

Question 5

A stakeholder requests that a specific finding be excluded from the final forensic report for business reasons. The investigator should:

Accepted Answer

Include the finding and document the request to omit it

Answer

Omit the finding to maintain the business relationship

Answer

Ask the stakeholder to sign a waiver before omitting

Answer

Rewrite the finding using ambiguous language

Question 6

What is the primary purpose of a closing briefing with stakeholders at the end of a forensic investigation?

Accepted Answer

To review findings, remediation steps, and lessons learned with relevant parties

Answer

To hand over all raw forensic images to management

Answer

To obtain signatures releasing the investigator from liability

Answer

To delete working copies of evidence from investigator workstations

Question 7

During an investigation, a department head outside the need-to-know circle asks the investigator directly about case status. The best response is to:

Accepted Answer

Confirm the investigation exists but direct them to the designated case contact

Answer

Share a high-level summary to maintain goodwill

Answer

Deny that any investigation is occurring

Answer

Provide the full report under confidentiality agreement