PCI Digital & Cyber Investigation 3

Question 1

An investigator obtains a suspect's cell tower records without a warrant. Under which legal doctrine might this evidence be excluded?

Accepted Answer

Fruit of the poisonous tree

Answer

Evidence derived from an illegal search or seizure can be excluded under the fruit of the poisonous tree doctrine, which extends exclusion to derivative evidence.

Question 2

Which type of metadata found in a Microsoft Word document can reveal the document's original author even after the file has been shared?

Accepted Answer

Document properties and revision history

Answer

Word document properties store author name, company, revision history, and tracked changes that can identify the original creator.

Question 3

A corporate investigator is asked to review employee emails on a company-owned server without employee consent. Which factor MOST supports the legality of this action?

Accepted Answer

The employee signed an acceptable use policy acknowledging no expectation of privacy

Answer

An acceptable use policy that clearly states no expectation of privacy on company systems establishes the legal basis for reviewing employee communications.

Question 4

When analyzing network logs during a cybersecurity investigation, what does a high volume of outbound traffic to a single external IP during off-hours MOST likely indicate?

Accepted Answer

Potential data exfiltration or command-and-control communication

Answer

Unusual outbound traffic patterns to a single IP during off-hours are a classic indicator of data exfiltration or malware communicating with a command-and-control server.

Question 5

What is the MAIN purpose of a Chain of Custody document in a digital investigation?

Accepted Answer

To track the chronological handling and possession of evidence

Answer

Chain of custody documentation tracks who handled evidence, when, and what was done with it, establishing its integrity for court admissibility.

(PCI) Professional Certified Investigator Practice Test

(PCI) Professional Certified Investigator Practice Test

PCI Digital & Cyber Investigation 3