Questions

The following is a short list of review questions to help reinforce your learning and help you identify areas that require some improvement. The answers to the questions can be found in the Assessment section at the end of this book:

1. According to NIST SP 800-86, which is the third stage of a digital forensic investigation?

   A. Analysis

   B. Collection

   C. Reporting

   D. Examination

2. Which of the following is the most volatile data on a system?

   A. Paging file

   B. Swap file

   C. ARP cache

   D. Registers

3. Which type of evidence supports a theory of an investigation?

   A. Indirect evidence

   B. Best evidence

   C. Corroborative evidence

   D. All of the above

4. Which of the following is a factor in attribution?

   A. Chain of custody

   B. Asset

   C. Threat actor

   D. All of the above

5. How do we verify the integrity of data?

   A. Just copy and paste the data

   B. Use a VPN

   C. With a hash

   D. With encryption