I85PREP
⌘ K
CFN study materials
CFN study resources

CFN practice questions

One question at a time. Build your CFN understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Forensic Nursing Foundations and Professional Practice

A sexual assault nurse examiner (SANE) is describing the scope of forensic nursing practice to a new hospital orientation group. Which statement best captures the defining focus of forensic nursing?

  1. Managing hospital billing records for trauma admissions
  2. Providing legal advice to patients about whether to press criminal charges
  3. Applying nursing science to the care of patients and populations affected by violence, trauma, and legal issues Correct answer.
  4. Replacing law enforcement investigators at crime scenes

Explanation

Forensic nursing integrates nursing science with forensic science and legal processes to care for victims and perpetrators of violence and trauma. Its central focus is health care delivery combined with evidence collection and documentation, not legal counsel or law enforcement substitution.

Question 2Forensic Nursing Foundations and Professional Practice

During a forensic interview, a patient asks the nurse, 'Will what I tell you be kept private?' Which response best reflects the forensic nurse's obligation regarding confidentiality?

  1. Everything you say is fully confidential and cannot be shared with anyone.
  2. Information may be shared with the care team and, when legally required, with authorities; I will explain those limits. Correct answer.
  3. I must report everything you say to the police immediately without exception.
  4. Confidentiality does not apply to you because this is a forensic case.

Explanation

Forensic nurses must explain the limits of confidentiality honestly, including mandatory reporting, court orders, and team-based care needs. This preserves informed consent and trust while meeting legal obligations. Blanket promises of secrecy or blanket denial of privacy are both inaccurate.

Question 3Forensic Nursing Foundations and Professional Practice

Which document most directly sets out the ethical obligations of nurses to respect patient autonomy, maintain competence, and protect patient rights in forensic settings?

  1. The state vehicle registration manual
  2. The nursing profession's code of ethics Correct answer.
  3. The hospital's employee dress code policy
  4. The facility's cafeteria service standards

Explanation

A professional code of ethics articulates the core values and obligations of nursing, including autonomy, competence, and advocacy. Forensic nurses apply these principles when balancing patient welfare against legal demands. Administrative policies on dress or food service do not address ethical duties.

Question 4Forensic Nursing Foundations and Professional Practice

A forensic nurse is asked to testify in court about a patient encounter. Which action best demonstrates the professional standard of maintaining an accurate, contemporaneous medical-legal record?

  1. Including personal opinions about the patient's credibility in the chart
  2. Documenting the encounter days later from memory to ensure clarity
  3. Recording objective findings, quotes, and interventions at the time of care Correct answer.
  4. Leaving out findings that seem unimportant to avoid clutter

Explanation

Contemporaneous documentation of objective findings, patient statements, and interventions creates a reliable record that supports both care and legal proceedings. Delayed reconstruction, subjective credibility judgments, and omission of findings all undermine accuracy and objectivity.

Question 5Forensic Nursing Foundations and Professional Practice

Which best describes the role of the forensic nurse as a patient advocate when a victim is deciding whether to report an assault to law enforcement?

  1. Refusing care unless the patient agrees to report
  2. Making the reporting decision on the patient's behalf
  3. Providing information about options and supporting the patient's informed choice Correct answer.
  4. Pressuring the patient to report so evidence is not wasted

Explanation

Advocacy means informing patients of their options, respecting their autonomy, and supporting the decision they make. Coercion or decision-making on the patient's behalf violates autonomy and trust. Care should never be conditioned on reporting.

Question 6Forensic Nursing Foundations and Professional Practice

A forensic nurse working with a survivor of intimate partner violence notices personal distress after the encounter. Which action best reflects professional self-care and competence?

  1. Ignoring the distress because it signals weakness
  2. Using debriefing, supervision, or peer support to process the experience Correct answer.
  3. Sharing the patient's identifying details with friends for comfort
  4. Avoiding all future patients with similar histories

Explanation

Vicarious trauma is a recognized occupational risk, and structured debriefing, clinical supervision, and peer support are appropriate professional responses. Processing distress this way protects both the nurse's wellbeing and the quality of care. Breaching patient privacy or avoiding patients is not acceptable.

Question 7Forensic Nursing Foundations and Professional Practice

Which principle requires the forensic nurse to obtain a patient's voluntary agreement before conducting an examination or evidence collection, whenever the patient is capable of deciding?

  1. Beneficence
  2. Veracity
  3. Informed consent Correct answer.
  4. Fidelity

Explanation

Informed consent is the principle and process by which a capable patient voluntarily agrees to an examination or procedure after understanding its nature and implications. Beneficence concerns doing good, veracity truthfulness, and fidelity faithfulness to commitments, none of which alone captures voluntary agreement.

Question 8Forensic Nursing Foundations and Professional Practice

A patient lacks decision-making capacity after a traumatic injury, and emergency evidence collection is proposed. Which approach best aligns with ethical and legal standards?

  1. Ask a family member to sign a waiver releasing the nurse from all liability
  2. Proceed without any consent because forensic cases override capacity rules
  3. Proceed only as permitted by law and facility policy, using surrogate consent or emergency provisions as applicable Correct answer.
  4. Wait indefinitely until the patient regains capacity regardless of urgency

Explanation

When a patient lacks capacity, nurses follow legal and policy pathways such as surrogate consent or emergency exceptions that permit necessary care. Forensic context does not eliminate consent requirements. Indefinite delay may harm the patient, and liability waivers do not substitute for valid authorization.

Question 9Forensic Nursing Foundations and Professional Practice

Which action best reflects the forensic nurse's duty regarding chain of custody when collecting a patient's clothing as evidence?

  1. Storing the clothing in a personal locker until the end of the shift
  2. Documenting each transfer of the item and securing it in a labeled, sealed container Correct answer.
  3. Allowing multiple staff to handle the item without recording who did so
  4. Placing the clothing in an unlabeled bag for later sorting

Explanation

Chain of custody requires documenting every person who handles evidence and keeping items in labeled, sealed containers to preserve integrity. Unlabeled storage, personal lockers, and undocumented handling all create gaps that can render evidence inadmissible.

Question 10Forensic Nursing Foundations and Professional Practice

A SANE program wants to strengthen its compliance with professional standards. Which resource most specifically provides guidelines for forensic nursing practice and education?

  1. The local fire department's evacuation plan
  2. A general first-aid poster in the break room
  3. Forensic nursing professional organizations and their published standards Correct answer.
  4. The hospital's marketing brochure

Explanation

Professional forensic nursing organizations publish standards of practice, education guidelines, and competencies that programs use for quality improvement. Evacuation plans, marketing materials, and first-aid posters do not address forensic nursing standards.

Question 11Forensic Nursing Foundations and Professional Practice

During testimony, an attorney asks the forensic nurse a question outside the nurse's documented observations. Which response best reflects appropriate courtroom conduct?

  1. Argue with the attorney about the question's fairness
  2. Guess confidently to appear knowledgeable
  3. Refuse to answer any questions at all
  4. State clearly what is known from documentation and decline to speculate beyond it Correct answer.

Explanation

Expert and fact witnesses are expected to testify accurately within the limits of their knowledge and documentation. Speculating damages credibility, while blanket refusal or argumentativeness is inappropriate. Clear, honest boundaries are the professional standard.

Question 12Forensic Nursing Foundations and Professional Practice

Which situation best illustrates the forensic nurse fulfilling the role of a mandatory reporter?

  1. Waiting to see whether the injury worsens before acting
  2. Notifying the designated authority about suspected child abuse in accordance with state law Correct answer.
  3. Discussing the case with a neighbor who is curious
  4. Deciding not to report because the family requested silence

Explanation

Mandatory reporting laws require nurses to notify designated authorities when they suspect certain harms, such as child abuse, regardless of family preference. Reporting through proper channels protects the patient and complies with law. Gossip, delay, and family requests do not override the duty.

Question 13Forensic Nursing Foundations and Professional Practice

Which statement best distinguishes the forensic nurse's health care role from the law enforcement role during a patient encounter?

  1. The nurse prioritizes the patient's health needs and evidence preservation, while law enforcement investigates and enforces the law Correct answer.
  2. The nurse's primary duty is to determine whether a crime occurred
  3. The nurse and police have identical responsibilities and can be substituted for one another
  4. The nurse should direct police strategy during the investigation

Explanation

Forensic nursing centers on health care, trauma-informed support, and proper evidence preservation, while law enforcement investigates crimes and enforces laws. These roles collaborate but are distinct. Nurses do not determine criminality or direct police strategy.

Question 14Forensic Nursing Foundations and Professional Practice

A forensic nurse notices a colleague documenting findings in a chart before actually completing the examination. What is the most appropriate professional response?

  1. Copy the same documentation practice to save time
  2. Confront the colleague publicly in front of the patient
  3. Address the concern through appropriate channels such as a supervisor or quality process Correct answer.
  4. Ignore it because documentation habits are personal

Explanation

Pre-documenting findings that have not occurred is falsification and a serious integrity and legal problem. The appropriate response is to raise the concern through supervisory or quality channels so it can be corrected and prevented. Ignoring, public confrontation, or imitation is inappropriate.

Question 15Forensic Nursing Foundations and Professional Practice

Which term describes the process by which a forensic nurse provides emotional support, information, and referrals while respecting a survivor's choices after violence?

  1. Triage scoring
  2. Trauma-informed advocacy Correct answer.
  3. Interrogation
  4. Cross-examination

Explanation

Trauma-informed advocacy provides support, information, and referrals while honoring the survivor's autonomy and avoiding re-traumatization. Interrogation and cross-examination are legal processes, and triage scoring prioritizes clinical urgency rather than support and referral.

Question 16Forensic Nursing Foundations and Professional Practice

A forensic nurse is preparing to collect evidence from a patient who is visibly intoxicated and confused. Which action best reflects professional and ethical practice?

  1. Assess capacity and safety, provide needed care, and follow policy on consent and timing Correct answer.
  2. Skip documentation to avoid embarrassing the patient
  3. Ask the patient to sign consent and proceed regardless of confusion
  4. Proceed with full evidence collection immediately because time is critical

Explanation

When a patient appears intoxicated or confused, the nurse must assess capacity and immediate safety needs and follow consent policies before evidence collection. Rushing ahead with an incapable patient, obtaining signature without understanding, or omitting documentation all violate standards.

Question 17Forensic Nursing Foundations and Professional Practice

Which activity best demonstrates the forensic nurse engaging in continuing professional development?

  1. Avoiding new research to preserve traditional methods
  2. Attending a conference or training on updated forensic evidence and trauma care Correct answer.
  3. Relying solely on skills learned during initial licensure
  4. Declining peer review of case documentation

Explanation

Continuing education keeps forensic nurses current on evolving evidence methods, trauma care, and legal standards. Relying only on initial training, rejecting research, and avoiding peer review all undermine competence and quality.

Question 18Forensic Nursing Foundations and Professional Practice

A forensic nurse is asked to describe the concept of 'forensic' in forensic nursing. Which meaning is most accurate?

  1. Pertaining to the legal system and the application of science to legal matters Correct answer.
  2. Pertaining to hospital food safety inspections
  3. Pertaining exclusively to psychiatric medication management
  4. Pertaining only to surgical procedures

Explanation

The term forensic refers to the legal system and the application of scientific methods to questions of law. Forensic nursing applies this to health care and evidence. Surgery, food safety, and psychiatric medication are separate domains.

Question 19Forensic Nursing Foundations and Professional Practice

A hospital wants to ensure forensic nurses understand their obligations when a patient's records are subpoenaed. Which action best reflects appropriate professional practice?

  1. Following facility legal process, verifying the subpoena, and releasing records as authorized Correct answer.
  2. Deleting portions of the record that seem unfavorable
  3. Immediately mailing the entire chart to the attorney who requested it
  4. Discussing the subpoena details with other patients

Explanation

Subpoenas require verification and handling through the facility's legal or release-of-information process to ensure only authorized records are disclosed. Direct release, alteration, or public discussion of records violates privacy and legal standards.

Question 20Forensic Nursing Foundations and Professional Practice

Which statement best reflects the ethical principle of nonmaleficence in forensic nursing?

  1. Maximizing benefits to the patient regardless of risk
  2. Avoiding actions that cause unnecessary harm during examination and evidence collection Correct answer.
  3. Keeping promises made to the patient
  4. Telling the patient only what the nurse believes is reassuring

Explanation

Nonmaleficence is the duty to avoid causing unnecessary harm, which in forensic nursing means minimizing physical and emotional trauma during examination and evidence collection. Maximizing benefit reflects beneficence, selective reassurance conflicts with veracity, and keeping promises reflects fidelity.

Question 21Forensic Evaluation, Documentation, and Evidence Collection

During a forensic interview, the investigator should document the interviewee's exact words in quotation marks because:

  1. quotations make the report look more professional to the court
  2. paraphrasing is prohibited by all evidence-handling standards
  3. quoted statements are automatically admissible while paraphrases are not
  4. verbatim statements preserve the witness's original wording for later comparison and impeachment Correct answer.

Explanation

Verbatim quotation preserves the precise wording of a statement, which later allows comparison with other accounts and supports impeachment or corroboration. Paraphrase risks altering meaning and cannot be reliably attributed to the speaker. Admissibility is decided by rules of evidence, not by whether a report uses quotation marks.

Question 22Forensic Evaluation, Documentation, and Evidence Collection

Which practice best preserves the integrity of a volatile-memory capture on a running workstation before analysis?

  1. Take screenshots of Task Manager and shut down
  2. Capture physical memory to a write-once location and record a hash of the image Correct answer.
  3. Copy only the pagefile to a USB drive and continue working
  4. Reboot the machine to clear malware, then image the disk

Explanation

Volatile data such as RAM must be captured before shutdown, written to controlled media, and hashed to demonstrate integrity. Reboots or shutdowns destroy the very evidence sought. Partial copies and screenshots do not preserve the full memory space.

Question 23Forensic Evaluation, Documentation, and Evidence Collection

The primary purpose of maintaining a chain of custody record is to:

  1. prove the investigator personally collected every item
  2. document who handled evidence, when, and under what conditions Correct answer.
  3. satisfy insurance requirements for the organization
  4. replace the need for hashing digital images

Explanation

A chain of custody documents each transfer and handling event so the evidence's integrity can be demonstrated at trial. It does not require one person to collect everything, and it complements rather than replaces hashing. Its purpose is evidentiary, not administrative compliance.

Question 24Forensic Evaluation, Documentation, and Evidence Collection

When photographing a crime scene involving a computer, the forensic photographer should first capture:

  1. images of the device after it has been powered off
  2. overall and mid-range views showing the device in its surroundings Correct answer.
  3. screenshots of the operating system desktop
  4. close-ups of individual ports and cables

Explanation

Scene photography proceeds from overall to mid-range to close-up so context is established before detail. Overall views show the device's position and connections in the environment. Close-ups and screen captures come later, and altering power state before documentation changes the scene.

Question 25Forensic Evaluation, Documentation, and Evidence Collection

A forensic report that states an examiner's conclusion should also include the basis for that conclusion because:

  1. the reasoning allows an independent reviewer to evaluate the finding Correct answer.
  2. courts require conclusions to be unanimous among examiners
  3. longer reports are considered more credible
  4. conclusions without reasoning are inadmissible in every jurisdiction

Explanation

Documenting the analytical basis lets a reviewer or fact-finder assess whether the conclusion follows from the evidence. It supports transparency and reproducibility of forensic work. Unanimity and length are not the criteria, and admissibility rules vary by jurisdiction.

Question 26Forensic Evaluation, Documentation, and Evidence Collection

Which item is most appropriately documented as a distinct evidence entry rather than grouped with the host computer?

  1. A removable USB drive found in the suspect's pocket Correct answer.
  2. The internal hard drive installed in the seized laptop
  3. The laptop's built-in keyboard
  4. The power adapter connected to the laptop

Explanation

Separate items with independent provenance, such as a USB drive found on the person, should be logged as their own evidence entries with distinct identifiers. Components integral to a single seized device are typically documented together with that device. Independent packaging and tracking preserve the item's history.

Question 27Forensic Evaluation, Documentation, and Evidence Collection

Forensic documentation should record the date and time of each action using:

  1. local time without noting the zone
  2. the examiner's personal watch with no reference
  3. a consistent time source and stated time zone Correct answer.
  4. the time shown on the suspect's device

Explanation

Consistent time referencing, including the time zone, allows events to be correlated with system logs and other records. Unreferenced or device-supplied times introduce ambiguity. A documented time source supports later reconstruction.

Question 28Forensic Evaluation, Documentation, and Evidence Collection

An examiner finds a handwritten note beside a seized phone. The best initial documentation step is to:

  1. photograph the note in place and log it as a separate item Correct answer.
  2. discard the note as unrelated to digital evidence
  3. fold the note into the phone's evidence bag
  4. write a summary of the note from memory later

Explanation

Physical items at a digital scene may carry evidentiary value and should be photographed in context and logged separately. Discarding or merging items loses provenance. Reconstructing content from memory is unreliable.

Question 29Forensic Evaluation, Documentation, and Evidence Collection

When an examiner uses a validated tool to parse a proprietary log format, the report should:

  1. rely on the tool's output without independent checks
  2. name the tool and version and describe how output was verified Correct answer.
  3. omit tool details to protect proprietary methods
  4. state only that the log was 'analyzed'

Explanation

Naming the tool and version, together with verification steps, allows another examiner to reproduce the analysis. Verification through manual checks or a second tool strengthens reliability. Vague descriptions and unverified reliance undermine the finding.

Question 30Forensic Evaluation, Documentation, and Evidence Collection

A defense reviewer challenges a timeline because the examiner converted UTC log times to local time incorrectly during daylight saving. The strongest response is to:

  1. argue that time zone errors are immaterial to findings
  2. remove the timeline from the report entirely
  3. recompute the timeline from raw timestamps with the documented offset applied Correct answer.
  4. rely on witness recollection to fix the times

Explanation

Rebuilding the timeline from original timestamps with the correct documented offset directly addresses the error and preserves reproducibility. Dismissing the issue or deleting the timeline avoids rather than resolves it. Witness memory is not a substitute for accurate log conversion.

Question 31Forensic Evaluation, Documentation, and Evidence Collection

Which documentation approach best supports a finding that a file was downloaded rather than merely present on a disk?

  1. Record only the file's existence in the directory listing
  2. Note the file's size and extension
  3. Rely on the file's creation date alone
  4. Correlate browser history, download records, and file system timestamps Correct answer.

Explanation

Establishing that a file was downloaded requires correlating multiple independent artifacts, such as browser download records and file system metadata. A single timestamp or directory entry shows presence, not the act of acquisition. Corroboration across sources strengthens the inference.

Question 32Forensic Evaluation, Documentation, and Evidence Collection

During acquisition, an examiner notes bad sectors on a drive. The proper documentation practice is to:

  1. replace the drive with a known-good copy and discard the original
  2. ignore the errors to keep the image process moving
  3. record the errors, their locations, and any imaging tool messages Correct answer.
  4. stop and declare the drive unrecoverable

Explanation

Imaging errors should be logged with locations and tool output so that gaps in the image are known and can be explained. Ignoring errors conceals incomplete acquisition. Discarding the original destroys the best evidence.

Question 33Forensic Evaluation, Documentation, and Evidence Collection

An investigator interviews a witness and later learns the witness recanted part of the statement. The case file should:

  1. replace the original statement with the corrected version
  2. note the recantation only in the investigator's memory
  3. delete the recanted portion to avoid confusion
  4. retain the original statement and add a dated record of the recantation Correct answer.

Explanation

Contemporaneous records should be preserved, with later changes documented as dated additions. Replacing or deleting original material obscures the record's history. Both versions may be relevant to assessing credibility.

Question 34Forensic Evaluation, Documentation, and Evidence Collection

Which hashing practice best demonstrates that an evidence image remained unchanged from acquisition to analysis?

  1. Record the file size instead of a hash
  2. Hash only the source drive before imaging
  3. Hash at acquisition and re-hash before analysis, comparing the values Correct answer.
  4. Hash the image once immediately after acquisition and never again

Explanation

Comparing a hash taken at acquisition with one taken before analysis shows whether the image changed in storage. A single hash cannot detect later alteration. File size is a weak integrity indicator compared with a cryptographic hash.

Question 35Forensic Evaluation, Documentation, and Evidence Collection

A forensic report includes a conclusion that a suspect 'intentionally deleted' files. Which documentation would best support that conclusion?

  1. A witness statement that the suspect used the computer
  2. Recovery of deleted-file metadata and user-action artifacts tied to the account Correct answer.
  3. The absence of the files from the current directory
  4. The presence of antivirus software on the system

Explanation

Intent requires evidence linking a specific user action to the deletion, such as deleted-file metadata and account activity artifacts. Mere absence of files or general computer use does not establish intentional conduct. Supporting artifacts must be documented and correlated.

Question 36Forensic Evaluation, Documentation, and Evidence Collection

When packaging a mobile phone for transport, the examiner should document whether the device was placed in a shielded bag and:

  1. the device's network state and any isolation measures applied Correct answer.
  2. the suspect's opinion of the bag
  3. the retail price of the device
  4. the bag's color and brand

Explanation

Documenting network state and isolation measures shows whether remote wiping or network activity could have altered the device. Shielded-bag use alone is insufficient without recording connectivity status. This supports later claims about device integrity.

Question 37Forensic Evaluation, Documentation, and Evidence Collection

An examiner prepares to testify about a report written by a colleague who is unavailable. The best practice is to:

  1. testify to conclusions in the report without reviewing the underlying data
  2. rely solely on the colleague's summary paragraph
  3. decline to testify under any circumstances
  4. review the underlying data and be prepared to explain the methodology Correct answer.

Explanation

A testifying examiner should understand the data and methodology behind any conclusion offered. Reviewing underlying records allows accurate testimony and exposes any gaps. Relying on conclusions alone risks misrepresenting the analysis.

Question 38Forensic Evaluation, Documentation, and Evidence Collection

Which record best establishes that an evidence locker remained secured between seizure and analysis?

  1. The locker's manufacturer documentation
  2. An oral assurance from the property clerk
  3. A photograph of the locker door
  4. A signed log of access events with dates, times, and purposes Correct answer.

Explanation

A contemporaneous access log records who entered the storage area and why, supporting the claim that evidence was not tampered with. Oral assurances are not reviewable, and a photograph or manufacturer document does not show access history.

Question 39Forensic Evaluation, Documentation, and Evidence Collection

An examiner finds that two independent tools report different creation timestamps for the same file. The report should:

  1. choose the earlier timestamp without comment
  2. document both results and explain the discrepancy or its unresolved status Correct answer.
  3. omit the timestamp entirely
  4. average the two timestamps

Explanation

Conflicting tool outputs should be transparently documented with any explanation or noted as unresolved. Selecting or averaging values without justification misrepresents the data. Omitting the conflict conceals uncertainty from the fact-finder.

Question 40Forensic Evaluation, Documentation, and Evidence Collection

A forensic examiner documents an examination of a cloud account using data exported by the provider. Which detail is most important to record for reproducibility?

  1. The export parameters, date range, and provider response metadata Correct answer.
  2. The color scheme of the provider's dashboard
  3. The examiner's preferred browser
  4. The examiner's travel schedule

Explanation

Recording export parameters, scope, and provider metadata lets another examiner understand exactly what was obtained and assess completeness. Personal preferences and unrelated details do not affect reproducibility. Provider metadata also helps establish authenticity.

Question 41Forensic Evaluation, Documentation, and Evidence Collection

An examiner's notes contain an abbreviation whose meaning is unclear to a reviewer. The best corrective action before finalizing the report is to:

  1. define the abbreviation in a glossary and verify the notes' meaning with the author Correct answer.
  2. remove the abbreviation and any related findings
  3. leave the abbreviation and rely on the reviewer to infer it
  4. replace the abbreviation with a guess

Explanation

A report must be understandable to reviewers and courts, so abbreviations should be defined and ambiguous notes clarified by their author. Guessing or deleting findings compromises accuracy. A glossary supports clarity without altering substance.

Question 42Forensic Evaluation, Documentation, and Evidence Collection

A suspect's device clock was set two hours ahead of actual time. Logs on the device record an event at 14:00 device time. To correlate with a network log in UTC, the examiner must:

  1. use the device time unchanged in the timeline
  2. apply the documented offset to convert device time to a common reference Correct answer.
  3. assume the network log is wrong
  4. discard the device log as unreliable

Explanation

Correlation requires converting timestamps to a common reference using the documented offset between device time and actual time. Using device time unchanged misplaces the event. Neither log should be discarded solely because clocks differ.

Question 43Forensic Evaluation, Documentation, and Evidence Collection

An examiner concludes that a specific user account performed a series of actions. Which combination of documentation most strongly supports attributing actions to a person rather than an account?

  1. The account was logged in during the relevant period
  2. The account had administrative privileges
  3. Corroborating artifacts such as physical access records, device usage, and authentication events tied to the individual Correct answer.
  4. The device was connected to the internet

Explanation

Attributing activity to a person requires corroboration beyond account login, such as physical presence, device usage, and authentication records. Privilege level or connectivity shows capability, not identity. Multiple independent artifacts strengthen the attribution.

Question 44Forensic Evaluation, Documentation, and Evidence Collection

During review, an examiner notices that a report's conclusion exceeds what the documented artifacts support. The correct professional response is to:

  1. keep the conclusion because it was already drafted
  2. add unrelated artifacts to bolster the conclusion
  3. revise the conclusion to match the documented evidence and note the change Correct answer.
  4. ask a colleague to sign the original conclusion

Explanation

Conclusions must be bounded by documented evidence, and revising an overstated conclusion to match the record is the appropriate correction. Bolstering with unrelated material or having another person sign does not cure the overreach. Changes should be recorded for transparency.

Question 45Forensic Evaluation, Documentation, and Evidence Collection

An examiner must document a live response on a server that cannot be taken offline. Which sequencing best preserves evidential value?

  1. Immediately patch the system to stop the intrusion
  2. Run antivirus scans first, then collect logs
  3. Delete suspicious files to prevent further execution
  4. Capture volatile data and logs first, then perform changes with each action recorded Correct answer.

Explanation

When a system must remain live, volatile data and logs should be captured before actions that alter state, and every change should be recorded. Patching or deleting files destroys evidence and complicates reconstruction. Documentation of each action preserves the response's integrity.

Question 46Forensic Evaluation, Documentation, and Evidence Collection

A forensic examiner is documenting a seized laptop. Which identifier should be recorded to uniquely tie the physical device to the case file?

  1. The serial number printed on the device chassis Correct answer.
  2. The name of the user account last logged in
  3. The physical dimensions and color of the laptop
  4. The operating system version installed on the device

Explanation

The serial number is a manufacturer-assigned unique identifier that links the physical item to the documentation and chain-of-custody record. Recording it prevents confusion if multiple similar devices are seized and supports later authentication of the item in court.

Question 47Forensic Evaluation, Documentation, and Evidence Collection

During a forensic examination, an examiner creates a working copy of an evidence image. What is the primary reason for documenting the hash value of the working copy before analysis?

  1. To encrypt the working copy for secure storage
  2. To assign a case number to the working copy
  3. To compress the working copy and save disk space
  4. To prove the working copy is identical to the original evidence image Correct answer.

Explanation

A cryptographic hash of the working copy, compared with the hash of the original image, demonstrates that the copy is a bit-for-bit duplicate. This verification supports the integrity of the evidence and shows that analysis was performed on an unaltered duplicate rather than the original.

Question 48Forensic Evaluation, Documentation, and Evidence Collection

An examiner is collecting volatile data from a running system. Which documentation practice best preserves the evidentiary value of the collected data?

  1. Noting the system time and the examiner's time for each command executed Correct answer.
  2. Waiting until the system is shut down to document the commands used
  3. Recording only the final output of each command without noting the time
  4. Summarizing the collected data in a narrative without raw output

Explanation

Volatile data can change rapidly, so documenting both the system clock and the examiner's clock at the time of collection helps establish when the data was captured and how it relates to other events. This dual time recording supports later timeline analysis and challenges about temporal accuracy.

Question 49Forensic Evaluation, Documentation, and Evidence Collection

A forensic report includes a statement that a file was created on a specific date based on the file system timestamp. Which additional documentation would best support the reliability of that conclusion?

  1. The file's size and extension
  2. The examiner's opinion that the timestamp is accurate
  3. The source of the timestamp and any known limitations of that source Correct answer.
  4. The number of files in the same directory

Explanation

File system timestamps can be affected by clock settings, time zone handling, and system behavior, so the report should identify where the timestamp came from and note any limitations. This allows a reviewer to assess whether the conclusion is supported by the underlying artifact.

Question 50Forensic Evaluation, Documentation, and Evidence Collection

An examiner is preparing a report on a network intrusion. The report must explain how a particular IP address was attributed to a specific internal host. Which documentation approach best supports this attribution?

  1. Including the DHCP lease logs and ARP cache entries with timestamps Correct answer.
  2. Listing the IP address without further context
  3. Relying on the suspect's confession to confirm the host
  4. Stating that the IP address is dynamically assigned

Explanation

Attribution of an IP address to a host requires correlating time-stamped records such as DHCP leases and ARP cache entries, which show which device held the address at the relevant time. Documenting these sources allows a reviewer to verify the link independently.