When collecting evidence from the RAM, where do you look for data?

A rogue/unauthorized access point is one that Is not authorized for operation by a particular firm or
network

Computer security logs contain information about the events occurring within an organization’s systems
and networks. Application and Web server log files are useful in detecting web attacks. The source,
nature, and time of the attack can be determined by _________of the compromised system.

Deposition enables opposing counsel to preview an expert witness’s testimony at trial. Which of the
following deposition is not a standard practice?

If a file (readme.txt) on a hard disk has a size of 2600 bytes, how many sectors are normally allocated to
this file?

Recovery of the deleted partition is the process by which the investigator evaluates and extracts the
deleted partitions.

During first responder procedure you should follow all laws while collecting the evidence, and contact a
computer forensic examiner as soon as possible

Which one of the following is not a consideration in a forensic readiness planning checklist?

When collecting electronic evidence at the crime scene, the collection should proceed from the most
volatile to the least volatile

What is a chain of custody?