When creating a forensic image of a hard drive, which of the following should be the FIRST step?

Which of the following disaster recovery testing techniques is the MOST cost-effective way to determine the
effectiveness of the plan?

When electronically stored information is requested during a fraud investigation, which of the following should be the FIRST priority?

Recovery point objectives (RPOs) can be used to determine which of the following?

Which of the following recovery strategies has the GREATEST chance of failure?

In the course of examining a computer system for forensic evidence, data on the suspect media were
inadvertently altered. Which of the following should have been the FIRST course of action in the investigative
process?

Of the following, which is the MOST important aspect of forensic investigations?

Which of the following would be MOST appropriate for collecting and preserving evidence?

Which of the following would be a MAJOR consideration for an organization defining its business continuity plan
(BCP) or disaster recovery program (DRP)?

An unauthorized user gained access to a merchant’s database server and customer credit card information.
Which of the following would be the FIRST step to preserve and protect unauthorized intrusion activities?