QUESTION 1 1. Having a digital camera in the response kit is important because of (choose all that apply): [Scene documentation. Potentially video recording the scene. Phones have inadequate lenses. Potential future testimony. To record audio. LL LL QUESTION 2 1. The order of volatility of evidence from least to most is: Live system, Network, Running, Virtual, and Physical. Virtual, Live system, Running, Network, and Physical. Physical, Virtual, Network, Running, and Live system. Live system, Running, Network, Virtual, and Physical. C Physical, Virtual, Running, Network, and Live system. QUESTION 3 1. If not considered, this/these can cause issues for digital forensic examiners: Illicit activities. Dates and time zones. Binary arithmetic. Universal time (UTC). Hexadecimal digits. QUESTION 4 1. Pelican cases are particularly useful because they: Come in many colours. Transport pelicans. Act as a Faraday bag. Are sturdy and waterproof. Are lightweight and easy to carry. QUESTION 5 1. Software security keys are also called: Dongles. Apps. CRAM. c USB drives. C Thumb drives. QUESTION 6 1. Hash analysis can be used to choose all that apply): Determine file types. Exclude files. Identify files. Verify the integrity of evidence. Crack complex passwords. QUESTION 7 1. A bottleneck that a forensic investigator may experience with their workstation is: CRAM. SSD speed. Monitor resolution. CPU speed. Data transfer. QUESTION 12 1. The best working copy for a digital forensic exam is: A logical forensic image. The original evidence item. A forensic copy. A forensic image. A forensic copy or image. QUESTION 13 1. Software security keys are also called: C Dongles. Apps. RAM. USB drives. Thumb drives. QUESTION 14 1. The response kit is: Not too important to success. Standard across organizations. Occasionally useful in the field. Assembled at the last minute. Unique to each digital forensic examiner. QUESTION 15 1. Pre-investigation considerations require: A one-time cost. Security clearance. Greater efficiency. Determining your capabilities in the field or the lab. Conducting a forensic examination. Organizational paperwork includes (choose all that apply): Labels and tags. Sketches. Incorporation documents. Notepads. Property reports