In what way do the procedures for dealing with evidence in a criminal case differ from the
procedures for dealing with evidence in a civil case?
A. evidence procedures are not important unless you work for a law enforcement agency
B. evidence must be handled in the same way regardless of the type of case
C. evidence in a civil case must be secured more tightly than in a criminal case
D. evidence in a criminal case must be secured more tightly than in a civil case
Which part of the Windows Registry contains the user's password file?
If a suspect's computer is located in an area that may have toxic chemicals, you must
A. coordinate with the HAZMAT team
B. do not enter alone
C. assume the suspect machine is contaminated
D. determine a way to obtain the suspect computer
Profiling is a forensics technique for analyzing evidence with the goal of identifying the
perpetrator from their pervious activity. After a computer has been compromised by a hacker,
which of the following would be most important in forming a profile of the incident?
A. The vulnerability exploited in the incident
B. The manufacture of the system compromised
C. The nature of the attack
D. The logic, formatting and elegance of the code used in the attack