When first analyzing an intrusion that has just been detected and confirming that it is a true positive, which of
the following actions should be done as a first step if you wish to prosecute the attacker in court?

When a possible intrusion into your organization’s information system has been detected, which of the following
actions should be performed first?

Why would a memory dump be admissible as evidence in court?

Which of the following would be MOST important to guarantee that the computer evidence will be admissible in
court?

This type of supporting evidence is used to help prove an idea or a point, however it cannot stand on its own, it
is used as a supplementary tool to help prove a primary piece of evidence. What is the name of this type of
evidence?

Which of the following proves or disproves a specific act through oral testimony based on information gathered
through the witness’s five senses?

A copy of evidence or oral description of its contents; which is not as reliable as best evidence is what type of
evidence?

What is called an exception to the search warrant requirement that allows an officer to conduct a search without
having the warrant in-hand if probable cause is present and destruction of the evidence is deemed imminent?

What is the PRIMARY reason to maintain the chain of custody on evidence that has been collected?

Which of the following would be LESS likely to prevent an employee from reporting an incident?