CSX Evidence Collection & Preservation 3

Question 1

In network forensics, which data source provides the most comprehensive record of packet-level communications?

Accepted Answer

Full packet capture (PCAP) files

Answer

Full packet capture files contain the complete contents of every network packet, providing the most detailed record of network communications.

Question 2

An investigator discovers that a suspect deleted files before the system was seized. Where should the investigator look to potentially recover these files?

Accepted Answer

Unallocated disk space

Answer

Deleted files are often recoverable from unallocated disk space until that space is overwritten with new data.

Question 3

Which standard defines the Open Forensics format commonly used for storing forensic disk images?

Accepted Answer

AFF4

Answer

AFF4 (Advanced Forensic Format 4) is a widely used open forensic container format for storing disk images and associated metadata.

Question 4

What is the significance of 'slack space' in a digital forensics investigation?

Accepted Answer

It may contain remnants of previously stored data

Answer

Slack space is the unused area between the end of a file and the end of its last allocated cluster, which may contain fragments of previously deleted data.

Question 5

A CISO needs to ensure that cloud-stored evidence is legally admissible. Which document should be obtained from the cloud provider?

Accepted Answer

Chain of custody affidavit

Answer

A chain of custody affidavit from the cloud provider documents who had access to the data, supporting its admissibility in court.

(CSX) Cybersecurity Nexus Certification Practice Test

(CSX) Cybersecurity Nexus Certification Practice Test

CSX Evidence Collection & Preservation 3