Questions

Answer the following to test your knowledge of this chapter:

1. What is not part of a forensic report?
   1. The tools utilized
   2. Examiner biography / CV
   3. Notes
   4. Exhibit list
2. When preparing an incident report, it is necessary to take into account the audience that will read it.
   1. True
   2. False
3. Which of these is a data source that can be leveraged in preparing an incident report?
   1. Applications
   2. Network/host devices
   3. Forensic tools
   4. All of the above
4. Incident responders should never include a root cause analysis as part of the incident report.
   1. True
   2. False