PCI Digital & Cyber Investigation 3 — Questions and Answers
Question 1: An investigator obtains a suspect's cell tower records without a warrant. Under which legal doctrine might this evidence be excluded?
- Fruit of the poisonous tree (Correct answer)
- Plain view doctrine
- Inevitable discovery
- Good faith exception
Correct answer: Fruit of the poisonous tree
Evidence derived from an illegal search or seizure can be excluded under the fruit of the poisonous tree doctrine, which extends exclusion to derivative evidence.
Question 2: Which type of metadata found in a Microsoft Word document can reveal the document's original author even after the file has been shared?
- File allocation table entries
- Document properties and revision history (Correct answer)
- NTFS alternate data streams
- File system timestamps only
Correct answer: Document properties and revision history
Word document properties store author name, company, revision history, and tracked changes that can identify the original creator.
Question 3: A corporate investigator is asked to review employee emails on a company-owned server without employee consent. Which factor MOST supports the legality of this action?
- The employee signed an acceptable use policy acknowledging no expectation of privacy (Correct answer)
- The investigation is criminal in nature
- The IT department has system administrator access
- The emails are older than 90 days
Correct answer: The employee signed an acceptable use policy acknowledging no expectation of privacy
An acceptable use policy that clearly states no expectation of privacy on company systems establishes the legal basis for reviewing employee communications.
Question 4: When analyzing network logs during a cybersecurity investigation, what does a high volume of outbound traffic to a single external IP during off-hours MOST likely indicate?
- Normal scheduled backup operations
- Potential data exfiltration or command-and-control communication (Correct answer)
- Employee downloading personal files
- Misconfigured network time protocol
Correct answer: Potential data exfiltration or command-and-control communication
Unusual outbound traffic patterns to a single IP during off-hours are a classic indicator of data exfiltration or malware communicating with a command-and-control server.
Question 5: What is the MAIN purpose of a Chain of Custody document in a digital investigation?
- To list the technical specifications of forensic tools used
- To track the chronological handling and possession of evidence (Correct answer)
- To document the suspect's criminal history
- To record the investigator's hours worked on the case
Correct answer: To track the chronological handling and possession of evidence
Chain of custody documentation tracks who handled evidence, when, and what was done with it, establishing its integrity for court admissibility.
Question 6: A PCI investigator finds a deleted file in unallocated space on a hard drive. What does 'unallocated space' mean in forensic terms?
- Space reserved for the operating system
- Disk sectors not currently assigned to any active file (Correct answer)
- Encrypted partitions inaccessible to the OS
- Space reserved for future disk expansion
Correct answer: Disk sectors not currently assigned to any active file
Unallocated space contains sectors previously used by deleted files that have not yet been overwritten, making file carving possible.
Question 7: During a phishing investigation, an investigator traces an email back through multiple servers. What is the CORRECT method to read email header routing information?
- Top to bottom, following the delivery path
- Bottom to top, from origin to final destination (Correct answer)
- Only the most recent 'Received' header matters
- Headers are unreliable and should be disregarded
Correct answer: Bottom to top, from origin to final destination
Email headers are read from bottom to top; the oldest 'Received' header at the bottom shows the origin, with each subsequent header showing the next relay.
PCI Digital & Cyber Investigation 3
An investigator obtains a suspect's cell tower records without a warrant.
Under which legal doctrine might this evidence be excluded?