I85PREP
⌘ K
PCI CFA study materials
PCI CFA study resources

PCI CFA practice questions

One question at a time. Build your PCI CFA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1PCI DSS Requirements and Scope

A merchant stores cardholder data in a database and transmits it to a payment processor. Which statement best describes how PCI DSS scope is determined for this environment?

  1. Scope is limited to the payment processor because the merchant only transmits data onward
  2. Scope includes the systems that store, process, or transmit cardholder data and those connected to them, so the database and its connected systems are in scope Correct answer.
  3. Scope covers only the database server because transmission to a processor is out of scope
  4. Scope covers only network devices that route traffic between the merchant and the processor

Explanation

PCI DSS scope is built around the cardholder data environment: systems that store, process, or transmit account data, plus systems that can impact the security of that environment. Connected-to and security-impacting systems therefore fall inside scope, not just the device holding the data. Transmission to a processor does not remove the merchant's own systems from scope.

Question 2PCI DSS Requirements and Scope

Which data element is considered sensitive authentication data and must not be stored after authorization, even in encrypted form?

  1. Cardholder name
  2. Full magnetic stripe track data Correct answer.
  3. Card expiration date
  4. Primary account number

Explanation

Sensitive authentication data includes full track data, the card verification code, and the PIN or PIN block. PCI DSS prohibits retaining this data after authorization even if it is encrypted. The primary account number, name, and expiration date are account data elements that may be stored if protected.

Question 3PCI DSS Requirements and Scope

Which of the following is one of the twelve high-level PCI DSS requirements?

  1. Encrypt all internal email traffic
  2. Install and maintain network security controls Correct answer.
  3. Retain audit logs for a minimum of ten years
  4. Perform penetration testing of every employee workstation

Explanation

Installing and maintaining network security controls is a core PCI DSS requirement addressing firewalls and network segmentation. The standard does not require encrypting all internal email, testing every workstation, or a ten-year log retention period. Log retention is at least twelve months with three months immediately available.

Question 4PCI DSS Requirements and Scope

A company wants to reduce PCI DSS scope by isolating its cardholder data environment from the corporate network. Which approach best supports this objective?

  1. Relying on host-based antivirus on each server
  2. Requiring multifactor authentication for administrators
  3. Encrypting the primary account numbers stored in the database
  4. Implementing network segmentation with controls that prevent traffic between the CDE and out-of-scope networks Correct answer.

Explanation

Network segmentation limits scope by preventing the cardholder data environment from communicating with out-of-scope systems. If segmentation is effective and validated, connected systems may be excluded from scope. Encryption, antivirus, and MFA are valuable controls but do not by themselves reduce scope boundaries.

Question 5PCI DSS Requirements and Scope

What is the primary purpose of the PCI DSS Self-Assessment Questionnaire?

  1. To define the technical configuration standards for firewalls
  2. To replace the requirement for an on-site assessment in all cases
  3. To certify payment applications for use at the point of sale
  4. To allow entities to validate compliance against applicable requirements based on their environment Correct answer.

Explanation

The Self-Assessment Questionnaire is a validation tool that lets eligible entities assess compliance against the requirements that apply to their environment. It does not eliminate assessments universally, certify applications, or set firewall standards. Applicability depends on the entity type and how it handles cardholder data.

Question 6PCI DSS Requirements and Scope

Which entity type is described as storing, processing, or transmitting cardholder data on behalf of merchants and must be PCI DSS compliant?

  1. Service provider Correct answer.
  2. Merchant bank
  3. Card brand
  4. Acquirer

Explanation

A service provider is a business entity that is not a payment brand and that stores, processes, or transmits cardholder data on behalf of another entity, or that could impact the security of that data. Service providers must be PCI DSS compliant and are typically validated accordingly. Acquirers and card brands are different roles in the payment chain.

Question 7PCI DSS Requirements and Scope

Which statement correctly distinguishes the primary account number from sensitive authentication data under PCI DSS?

  1. Both may be stored indefinitely if encrypted
  2. Sensitive authentication data may be stored if encrypted, while the primary account number may not
  3. The primary account number may be stored if protected, while sensitive authentication data must not be stored after authorization Correct answer.
  4. Neither may ever be stored in any form

Explanation

The primary account number is account data that may be retained when protected according to the standard. Sensitive authentication data must not be retained after authorization even when encrypted. This distinction drives data-retention and storage decisions.

Question 8PCI DSS Requirements and Scope

An entity outsources cardholder data processing to a third party. What is the entity's responsibility regarding PCI DSS?

  1. It may ignore PCI DSS until a breach occurs
  2. It remains responsible for ensuring its own compliance and for managing the service provider relationship Correct answer.
  3. It only needs to confirm the third party has any security certification
  4. It bears no responsibility because the third party is compliant

Explanation

Outsourcing does not transfer the entity's own compliance obligations, and the entity must manage its service providers, including confirming their PCI DSS status. The entity remains accountable for how cardholder data is handled on its behalf. Responsibility is shared but not eliminated.

Question 9PCI DSS Requirements and Scope

A retailer's point-of-sale terminals connect through a corporate network that also carries general office traffic. What is the most accurate scoping implication?

  1. The corporate network may be in scope because it is connected to the cardholder data environment Correct answer.
  2. Only the terminals are in scope because they touch cards
  3. Scope is limited to the payment processor
  4. The office traffic removes the network from scope

Explanation

Systems connected to the cardholder data environment can be in scope because they could impact its security. A shared corporate network carrying both POS and office traffic is a connected-to system unless segmentation isolates it. The presence of office traffic does not remove scope.

Question 10PCI DSS Requirements and Scope

Which activity best demonstrates that network segmentation is effective for reducing PCI DSS scope?

  1. Testing that out-of-scope systems cannot reach the cardholder data environment and that the CDE cannot initiate connections outward Correct answer.
  2. Assigning static IP addresses to CDE servers
  3. Documenting a firewall rule set once at implementation
  4. Encrypting all traffic within the CDE

Explanation

Segmentation must be verified to confirm that controls actually prevent communication between the CDE and out-of-scope networks in both directions. Documentation alone does not prove effectiveness, and testing should be repeated. Encryption and addressing choices do not establish segmentation boundaries.

Question 11PCI DSS Requirements and Scope

An entity stores only truncated primary account numbers with the last four digits visible. How does this affect PCI DSS applicability?

  1. Truncation automatically removes all systems from scope
  2. Truncation is prohibited under PCI DSS
  3. The data is no longer cardholder data, so PCI DSS does not apply at all
  4. Truncated data may still be cardholder data depending on the truncation method and remaining elements, so scope must be assessed Correct answer.

Explanation

Truncation can reduce risk, but whether the remaining data still qualifies as cardholder data depends on the method and other elements present. Scope must be assessed rather than assumed removed. Truncation is permitted when the full number cannot be reconstructed.

Question 12PCI DSS Requirements and Scope

Which requirement addresses restricting access to cardholder data by business need to know?

  1. Requirement 3
  2. Requirement 7 Correct answer.
  3. Requirement 11
  4. Requirement 10

Explanation

Requirement 7 limits access to system components and cardholder data to those whose job requires it, based on business need to know. Requirement 3 concerns stored account data protection, Requirement 10 covers logging, and Requirement 11 covers security testing.

Question 13PCI DSS Requirements and Scope

A service provider's customer asks for evidence of the provider's PCI DSS compliance. Which artifact most directly serves this purpose?

  1. A marketing brochure describing security features
  2. An Attestation of Compliance supported by a Report on Compliance or applicable SAQ Correct answer.
  3. A list of the provider's employees with security training
  4. A copy of the provider's firewall rules

Explanation

An Attestation of Compliance, supported by the appropriate validation report, is the standard evidence of PCI DSS compliance for a service provider. Firewall rules, training lists, and brochures are not compliance attestations. Customers rely on the AOC and associated report to manage the relationship.

Question 14PCI DSS Requirements and Scope

Which of the following best describes the role of the Report on Compliance?

  1. It replaces the need for any ongoing compliance activities
  2. It certifies individual payment terminals for sale
  3. It documents the results of an assessment performed by a Qualified Security Assessor against PCI DSS requirements Correct answer.
  4. It is a self-declared checklist completed by any merchant

Explanation

The ROC is produced by a Qualified Security Assessor and documents the assessment against PCI DSS requirements. It is not a self-declared checklist, does not certify hardware, and does not eliminate ongoing compliance work. It serves as detailed evidence supporting the AOC.

Question 15PCI DSS Requirements and Scope

A company plans to tokenize primary account numbers so that its internal systems handle tokens instead of cardholder data. What is the most accurate scoping statement?

  1. Tokenization may reduce scope where systems no longer store, process, or transmit cardholder data, but scope must be validated Correct answer.
  2. Tokenization is prohibited because it hides the account number
  3. Tokenization only applies to paper records
  4. Tokenization always removes all systems from scope regardless of implementation

Explanation

Tokenization can reduce scope when systems truly no longer handle cardholder data and the tokenization environment is properly isolated. Scope reduction must be validated rather than assumed. The tokenization system itself and any systems that can access cardholder data remain in scope.

Question 16PCI DSS Requirements and Scope

Which statement about the cardholder data environment is correct?

  1. It is defined solely by the physical data center
  2. It includes people, processes, and technology that store, process, or transmit cardholder data Correct answer.
  3. It includes only servers that hold databases
  4. It excludes any system that only transmits data

Explanation

The CDE comprises the people, processes, and technology that store, process, or transmit cardholder data or sensitive authentication data. It is broader than database servers and includes transmission paths. It is a logical and physical construct, not limited to a data center.

Question 17PCI DSS Requirements and Scope

An entity's wireless access points are on the same network segment as its cardholder data environment. What scoping conclusion follows?

  1. The wireless environment is in scope and must be assessed against applicable requirements Correct answer.
  2. Wireless is out of scope because it uses radio rather than cables
  3. Wireless is out of scope if WPA2 is enabled
  4. Wireless is in scope only if it carries payment traffic

Explanation

Wireless networks connected to or within the cardholder data environment are in scope and must meet applicable requirements, including configuration and testing. The use of radio transmission does not exclude it. Encryption alone does not remove scope.

Question 18PCI DSS Requirements and Scope

Which requirement family most directly addresses protecting stored account data?

  1. Requirement 1
  2. Requirement 6
  3. Requirement 3 Correct answer.
  4. Requirement 8

Explanation

Requirement 3 covers protection of stored account data, including retention limits and rendering data unreadable. Requirement 1 addresses network security controls, Requirement 6 secure development, and Requirement 8 identity and authentication. Each requirement family targets a distinct control area.

Question 19PCI DSS Requirements and Scope

A merchant uses a payment page hosted entirely by a PCI DSS compliant third party, and its own site never receives cardholder data. What is the most accurate scoping statement?

  1. The merchant has no PCI DSS obligations whatsoever
  2. The merchant must still build its own full cardholder data environment
  3. The merchant's scope may be reduced, but it must still manage the third-party relationship and confirm compliance for applicable requirements Correct answer.
  4. The merchant is out of scope only if it uses tokenization

Explanation

When a compliant third party handles all cardholder data, the merchant's own environment may be significantly reduced in scope. The merchant must still manage the service provider relationship and confirm compliance, and some requirements may still apply. Obligations are reduced, not eliminated.

Question 20PCI DSS Requirements and Scope

Which of the following best describes how sampling may be used in a PCI DSS assessment?

  1. Sampling may be used to avoid testing any system in the CDE
  2. Sampling results are valid only if every sampled item passes
  3. Assessors may sample system components and business facilities to represent the population when the sampling approach is documented and defensible Correct answer.
  4. Sampling is never permitted under any circumstances

Explanation

Assessors may use sampling to represent a population when the approach is documented and reasonable for the environment. Sampling does not permit skipping the CDE entirely, and exceptions found during sampling must be addressed rather than ignored. The methodology must be defensible.

Question 21PCI DSS Requirements and Scope

An entity discovers that a legacy application cannot be patched and still processes cardholder data. What is the most appropriate PCI DSS-aligned response?

  1. Encrypt the application's database and consider the requirement satisfied
  2. Ignore the issue because legacy systems are exempt
  3. Remove the application from scope without changes
  4. Document a compensating control that meets the intent of the requirement, with the constraint addressed and risk mitigated Correct answer.

Explanation

When a requirement cannot be met due to a documented constraint, a compensating control may be used if it meets the intent of the requirement and mitigates the risk. The constraint and control must be documented and validated. Legacy status alone does not create an exemption.

Question 22PCI DSS Requirements and Scope

A company argues that because its cardholder data is encrypted at rest, its connected corporate systems are out of scope. Which response is most accurate?

  1. Encryption at rest removes scope only if AES-256 is used
  2. Encryption at rest removes all connected systems from scope
  3. Encryption at rest removes scope only for databases, not applications
  4. Encryption at rest does not by itself remove connected-to systems from scope; segmentation or elimination of cardholder data handling is required Correct answer.

Explanation

Encryption protects stored data but does not change the fact that connected systems could impact the security of the cardholder data environment. Scope reduction for connected systems requires effective segmentation or removal of cardholder data handling. Encryption alone is not a scoping mechanism.

Question 23PCI DSS Requirements and Scope

Which situation most clearly indicates that an entity has failed to properly define its PCI DSS scope?

  1. The entity includes its logging server that receives CDE logs
  2. The entity includes its payment terminals in scope
  3. The entity documents a data-flow diagram and updates it annually
  4. The entity excludes a system that stores cardholder data backups because the backups are encrypted Correct answer.

Explanation

Excluding a system that stores cardholder data because it is encrypted is a scoping error; stored account data systems remain in scope and must meet protection requirements. Proper scope definition includes all systems that store, process, or transmit cardholder data and those that can impact its security. Documentation, terminals, and log servers are appropriately included.

Question 24PCI DSS Requirements and Scope

An entity wants to rely on a service provider's compliance to satisfy requirements for a cardholder data function. What must the entity do to support this position?

  1. Rely on the provider's general security policy alone
  2. Transfer all responsibility formally so the entity owes nothing
  3. Confirm the provider's PCI DSS compliance covers the relevant requirements and maintain evidence of the relationship and responsibilities Correct answer.
  4. Assume the provider covers all requirements without documentation

Explanation

An entity may rely on a service provider only for the requirements the provider actually covers, and it must confirm compliance and retain evidence of the relationship and shared responsibilities. General policies are insufficient, and responsibility cannot be fully transferred away. The entity remains accountable for its own compliance.

Question 25PCI DSS Requirements and Scope

Which statement correctly describes the relationship between the AOC and the ROC for a service provider?

  1. The ROC is issued by the card brand and the AOC by the merchant
  2. The AOC is the attestation summarizing compliance, and the ROC provides the detailed assessment results supporting it Correct answer.
  3. The AOC and ROC are interchangeable terms for the same document
  4. The AOC is the detailed testing narrative and the ROC is the summary signature page

Explanation

The Attestation of Compliance is a short attestation of compliance status, while the Report on Compliance contains the detailed assessment findings that support it. They serve different but related purposes. Neither is issued by a card brand or merchant as described.

Question 26PCI DSS Requirements and Scope

Under PCI DSS, which data element may be stored after authorization provided it is rendered unreadable or otherwise protected per the standard?

  1. The primary account number Correct answer.
  2. The three-digit card verification value printed on the signature panel
  3. The full magnetic stripe track data
  4. The personal identification number entered at a terminal

Explanation

The primary account number is the core cardholder data element and may be retained after authorization if it is protected as required by the standard, for example by strong cryptography. Sensitive authentication data such as full track data, card verification codes, and PINs must not be stored after authorization even if encrypted.

Question 27PCI DSS Requirements and Scope

An entity is designing its cardholder data environment and wants to minimize scope. Which approach best supports that goal?

  1. Storing cardholder data in multiple business applications to avoid single points of failure
  2. Connecting all internal systems to the same flat network so monitoring is centralized
  3. Isolating cardholder data functions in a dedicated segment with controlled entry points Correct answer.
  4. Allowing remote vendor access directly into the cardholder data environment for convenience

Explanation

Reducing scope means limiting where cardholder data lives and how systems connect to it. A dedicated segment with tightly controlled entry points keeps systems that do not need cardholder data out of the cardholder data environment, which reduces the systems subject to PCI DSS.

Question 28PCI DSS Requirements and Scope

Which statement best describes the relationship between the cardholder data environment and systems that connect to it?

  1. Connected systems are in scope only if they transmit full track data
  2. Connected systems may be in scope because they can affect the security of the cardholder data environment Correct answer.
  3. Connected systems are in scope only when they are owned by a service provider
  4. Connected systems are always out of scope because they do not store cardholder data

Explanation

Systems that connect to the cardholder data environment can provide an entry point into it and can therefore affect its security. Such connected systems and the controls between them are typically in scope for PCI DSS even when they do not themselves store, process, or transmit account data.

Question 29PCI DSS Requirements and Scope

An entity wants to reduce the number of systems subject to PCI DSS by keeping account data out of a business unit. Which action most directly accomplishes this?

  1. Implementing tokenization so the business unit handles tokens instead of account data Correct answer.
  2. Requiring the business unit to complete security awareness training
  3. Adding the business unit to the annual assessment sample
  4. Encrypting account data at rest within the business unit

Explanation

Tokenization replaces the account data with a surrogate value that has no exploitable value if compromised, so systems handling only tokens generally fall outside the cardholder data environment. Encryption does not remove scope because the systems still store account data and the associated keys and processes remain in scope.

Question 30PCI DSS Requirements and Scope

Which PCI DSS requirement most directly governs the protection of the primary account number when it is transmitted over open, public networks?

  1. Requirement 4, which addresses strong cryptography during transmission over open, public networks Correct answer.
  2. Requirement 12, which addresses organizational security policies
  3. Requirement 3, which addresses protection of stored account data
  4. Requirement 9, which addresses physical access to cardholder data

Explanation

Requirement 4 requires strong cryptography and security protocols to safeguard account data during transmission over open, public networks. Requirement 3 covers storage protection, so the two are frequently confused but address different data states.

Question 31PCI DSS Requirements and Scope

A company identifies a legacy application that still processes account data but can no longer be patched. What is the most appropriate course of action under PCI DSS?

  1. Ignore the risk because the application is internal only
  2. Remove the application from the network diagram so it is excluded from scope
  3. Document a compensating control that meets the intent of the requirement and validate it during assessment Correct answer.
  4. Encrypt the application's database and consider the patching requirement satisfied

Explanation

When a requirement cannot be met due to a legitimate technical or documented business constraint, the entity may define and implement a compensating control that meets the intent of the requirement. The control must be documented, maintained, and validated during the assessment, and the residual risk must be accepted by management.

Question 32PCI DSS Requirements and Scope

Which entity is responsible for confirming that its own systems and processes meet PCI DSS when it stores, processes, or transmits account data?

  1. The card brand alone
  2. The merchant or service provider that owns the systems Correct answer.
  3. The acquiring bank alone
  4. The assessment firm that performs the review

Explanation

Compliance responsibility rests with the entity that stores, processes, or transmits account data, or that could impact the security of that data. Acquiring banks and card brands set and enforce requirements, and assessors validate, but they do not assume the entity's compliance obligation.

Question 33PCI DSS Requirements and Scope

An entity's network diagram shows a firewall separating the cardholder data environment from the corporate network, but no rules or traffic flows are documented. Why is this a scoping weakness?

  1. The corporate network is automatically out of scope once a firewall exists
  2. The absence of documented flows makes it impossible to confirm which systems can reach account data Correct answer.
  3. Firewalls are not permitted between the cardholder data environment and corporate networks
  4. Network diagrams are optional for PCI DSS assessments

Explanation

Accurate scope definition depends on understanding every connection into and out of the cardholder data environment. Without documented rules and data flows, the entity cannot demonstrate which systems can reach account data, so scope cannot be reliably determined or defended.

Question 34PCI DSS Requirements and Scope

Which statement correctly describes how segmentation affects PCI DSS scope?

  1. Segmentation reduces scope only for service providers, not merchants
  2. Segmentation reduces scope only if it is implemented, documented, and verified as effective Correct answer.
  3. Segmentation reduces scope as soon as a firewall is purchased
  4. Segmentation has no effect on scope under any circumstances

Explanation

Segmentation can reduce the number of systems subject to PCI DSS by isolating the cardholder data environment, but only when the controls are implemented, documented, and tested to confirm they actually prevent access. Untested or undocumented segmentation cannot be relied upon to reduce scope.

Question 35PCI DSS Requirements and Scope

An entity stores account data in a cloud service and argues that the provider's compliance certificate removes the entity's own obligations. Which response is most accurate?

  1. The entity is out of scope only if it uses more than one provider
  2. The entity must become a service provider itself to be compliant
  3. The entity must still confirm the provider covers the relevant requirements and remains responsible for its own configuration and use of the service Correct answer.
  4. The entity has no obligations because the provider is compliant

Explanation

Using a compliant service provider does not transfer the entity's own PCI DSS responsibilities. The entity must confirm which requirements the provider covers, ensure its own configuration and integration are secure, and manage the provider relationship as required by the standard.

Question 36PCI DSS Requirements and Scope

Which activity is most useful for confirming that a firewall truly isolates the cardholder data environment?

  1. Confirming that the firewall has a current support contract
  2. Reviewing the firewall vendor's product certification
  3. Testing connectivity from out-of-scope networks to in-scope systems and confirming it is blocked Correct answer.
  4. Counting the number of rules configured on the firewall

Explanation

Effective segmentation must be verified, not assumed. Testing from networks that should be excluded to confirm they cannot reach in-scope systems demonstrates that the isolation works as intended and supports the scope claim.

Question 37PCI DSS Requirements and Scope

Which of the following best describes the purpose of the Report on Compliance?

  1. It documents an assessor's detailed evaluation of an entity's compliance with PCI DSS requirements Correct answer.
  2. It is a list of the entity's firewall rules
  3. It is the contract between a merchant and its acquiring bank
  4. It is a self-assessment questionnaire completed by any merchant

Explanation

The Report on Compliance is produced by a qualified assessor and records the detailed findings of an assessment against each PCI DSS requirement. It is distinct from the self-assessment questionnaire, which entities may complete themselves in defined circumstances.

Question 38PCI DSS Requirements and Scope

An entity's scope definition excludes a system that stores account data in a reporting database maintained by the finance team. What is the most likely consequence?

  1. The scope is valid because finance systems are always out of scope
  2. The entity must stop reporting on financial data
  3. The assessment will be incomplete and the entity's compliance claim will be unreliable Correct answer.
  4. The database automatically becomes compliant once excluded

Explanation

Any system that stores, processes, or transmits account data is part of the cardholder data environment regardless of which department owns it. Excluding such a system produces an inaccurate scope, leaving requirements unassessed and undermining the compliance conclusion.

Question 39PCI DSS Requirements and Scope

Which requirement family most directly addresses the protection of stored account data?

  1. Requirement 3, which addresses protection of stored account data Correct answer.
  2. Requirement 7, which addresses access restriction by business need to know
  3. Requirement 5, which addresses protection against malicious software
  4. Requirement 10, which addresses logging and monitoring

Explanation

Requirement 3 governs the protection of stored account data, including retention limits, masking, and cryptographic protection. Requirement 7 restricts access by business need to know and Requirement 10 covers logging, but neither is the primary storage protection requirement.

Question 40PCI DSS Requirements and Scope

A merchant's website redirects customers to a fully hosted payment page, and the merchant's own servers never receive account data. Which scoping conclusion is most defensible?

  1. The merchant's servers are out of scope for account data handling, but the merchant must still confirm the provider's compliance and secure its own site integrity Correct answer.
  2. The merchant must build its own payment page to be compliant
  3. The merchant's servers are in scope because the customer's browser is involved
  4. The merchant is entirely out of scope and has no PCI DSS obligations whatsoever

Explanation

When a fully hosted payment page ensures the merchant's systems never receive account data, those systems are generally excluded from the cardholder data environment. The merchant still must verify the provider's compliance and protect its own site, since a compromised merchant page could redirect or alter the payment flow.

Question 41Forensic Investigation Methodology and Evidence Handling

During a forensic investigation, which principle best describes Locard's exchange principle as applied to digital evidence?

  1. Evidence must be collected by a law enforcement officer to be admissible
  2. Digital evidence is always destroyed when a system is rebooted
  3. Every contact between a subject and a system leaves a trace that may be recovered Correct answer.
  4. Only physical evidence can be exchanged at a crime scene

Explanation

Locard's exchange principle holds that contact between two entities results in a transfer of material. In digital investigations this means an actor interacting with a system typically leaves artifacts such as logs, timestamps, or file remnants. Investigators rely on these traces to reconstruct activity.

Question 42Forensic Investigation Methodology and Evidence Handling

Which action best preserves the integrity of a hard drive seized as evidence before it is transported to a laboratory?

  1. Immediately image the drive on the suspect's machine to save time
  2. Run a full antivirus scan to remove malicious files
  3. Document the drive, photograph it, and place it in an antistatic evidence bag with a chain-of-custody form Correct answer.
  4. Delete temporary files to reduce the volume of data to analyze

Explanation

Seized media should be documented, photographed, and packaged in a manner that prevents alteration, with a chain-of-custody record started at seizure. This establishes who handled the item and when. Altering the drive before imaging compromises its evidentiary value.

Question 43Forensic Investigation Methodology and Evidence Handling

What is the primary purpose of maintaining a chain-of-custody record for digital evidence?

  1. To certify that the investigator holds a forensic license
  2. To record the suspect's statements during interrogation
  3. To encrypt evidence during storage
  4. To document every transfer and handling of evidence from seizure to disposition Correct answer.

Explanation

A chain-of-custody record provides an auditable history of who handled the evidence, when, and for what purpose. It supports authentication of evidence in legal proceedings by showing it was not tampered with. It does not encrypt data or certify credentials.

Question 44Forensic Investigation Methodology and Evidence Handling

Which type of data is most likely to be lost if a running computer is powered off before acquisition?

  1. Files saved to the hard drive weeks earlier
  2. Data stored in a mounted encrypted volume that is unlocked
  3. Volatile memory contents such as running processes and network connections Correct answer.
  4. Log files written to persistent storage

Explanation

Volatile data, including RAM contents, running processes, and active network connections, disappears when power is removed. Investigators often capture this data before shutdown. Persistent storage retains its contents across power cycles.

Question 45Forensic Investigation Methodology and Evidence Handling

In forensic imaging, what does a hash value computed over the source and the image primarily demonstrate?

  1. That the investigator has administrative privileges
  2. That the image is compressed efficiently
  3. That the source drive contained no deleted files
  4. That the image is a bit-for-bit match of the source at acquisition time Correct answer.

Explanation

A cryptographic hash computed over both source and image allows comparison to confirm the copy is identical to the original at the time of acquisition. Matching hashes support integrity and authenticity. Hash values do not indicate compression efficiency or the presence of deleted data.

Question 46Forensic Investigation Methodology and Evidence Handling

Which documentation practice best supports reproducibility of a forensic examination?

  1. Storing notes only on the examined system
  2. Relying on memory and writing the report at the end of the case
  3. Recording tool versions, commands executed, and timestamps in contemporaneous notes Correct answer.
  4. Sharing a single administrator account among the team

Explanation

Contemporaneous notes that capture tool versions, exact commands, and timestamps allow another examiner to reproduce the work and evaluate its reliability. This transparency strengthens the report's defensibility. Deferring documentation or storing it on the examined system undermines integrity.

Question 47Forensic Investigation Methodology and Evidence Handling

What is the main reason forensic examiners use write-blockers during acquisition?

  1. To prevent the examination host from modifying the source media Correct answer.
  2. To speed up the imaging process
  3. To encrypt the acquired image automatically
  4. To compress the image to save storage

Explanation

A write-blocker prevents write commands from reaching the source media so the original evidence is not altered during acquisition. This protects integrity and supports later authentication. Write-blockers do not encrypt or compress data and are not primarily a performance tool.

Question 48Forensic Investigation Methodology and Evidence Handling

Which statement correctly distinguishes a forensic image from a logical backup?

  1. A logical backup always includes unallocated space
  2. A forensic image only copies the operating system files
  3. Both capture identical data sets with no differences
  4. A forensic image captures a bit-for-bit copy of the media including unallocated space, while a logical backup typically copies selected files Correct answer.

Explanation

A forensic image reproduces the entire storage medium, including deleted and unallocated areas, preserving all potential evidence. A logical backup generally copies selected files or directories. The distinction matters because unallocated space can contain recoverable artifacts.

Question 49Forensic Investigation Methodology and Evidence Handling

An examiner receives a laptop that was found powered on. Which sequence best follows accepted practice for acquisition?

  1. Capture volatile data such as RAM and network state, then acquire persistent storage Correct answer.
  2. Reformat the drive to remove malware, then image
  3. Boot into the installed operating system and copy user folders
  4. Pull the power cord immediately, then image the drive

Explanation

When a system is live, volatile artifacts should be captured first because they will be lost on shutdown. Persistent storage can then be acquired in a controlled manner. Pulling power or booting the installed OS risks losing or altering evidence.

Question 50Forensic Investigation Methodology and Evidence Handling

A suspect's USB drive is received with no accompanying paperwork. What is the most appropriate first step?

  1. Image the drive and begin analysis immediately
  2. Test the drive by opening files in a word processor
  3. Document the condition and initiate a chain-of-custody record before any examination Correct answer.
  4. Return the drive to the suspect

Explanation

Evidence with incomplete paperwork should be documented on receipt and entered into a chain-of-custody record before examination. This establishes custody and condition. Proceeding without documentation or opening files directly risks integrity challenges.