CHFI Computer Forensics Lab Practice Question
A forensic lab in a shared office building must protect evidence against unauthorized physical access, environmental damage, and electromagnetic interference. The lab manager is documenting the physical controls for an accreditation audit. Which control best addresses the risk of an intruder removing a seized hard drive from the evidence room?
⚠ Common exam trap
Many candidates confuse environmental or handling safeguards such as UPS units and wrist straps with actual physical access controls that restrict who can reach the evidence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A locked evidence locker with a keypad entry log and tamper-evident seals on each evidence bag
The scenario asks for a control against unauthorized physical removal of evidence. Only a locked evidence locker with logged keypad access and tamper-evident seals both restricts entry and provides detection if a bag is opened. The other choices protect power continuity, block wireless signals, or prevent electrostatic damage, none of which stop an intruder from taking a drive.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A locked evidence locker with a keypad entry log and tamper-evident seals on each evidence bag
Why this is correct
A locked evidence locker with logged keypad entry and tamper-evident seals directly prevents and detects unauthorized removal of a seized drive. The entry log creates an auditable record of who accessed the evidence room, while the seals reveal any attempt to open an evidence bag after seizure. Together they satisfy the physical security and chain-of-custody expectations for a forensics lab.
- ✗
A UPS connected to the forensic workstation to prevent power loss during imaging
Why it's wrong here
A UPS protects the workstation and ongoing imaging from power interruptions, which is an availability control, not an access control. It does nothing to stop an intruder from walking into the evidence room and carrying off a seized hard drive. This option addresses environmental continuity rather than the physical theft risk described in the scenario.
- ✗
An antistatic wrist strap worn by the examiner while handling the drive
Why it's wrong here
An antistatic wrist strap discharges static electricity to protect sensitive electronics from electrostatic discharge damage during handling. It is a component-protection measure, not a security measure against theft or unauthorized access. Wearing one does not prevent an intruder from removing evidence from a locked room, so it does not address the stated risk.
- ✗
A Faraday bag used to store mobile phones during transport
Why it's wrong here
A Faraday bag blocks wireless signals to preserve volatile mobile device data and prevent remote wiping, which is a radio-frequency isolation control. It is not designed to secure a hard drive against physical removal from a lab evidence room. This option is relevant to mobile forensics transport, not to the access-control requirement in the scenario.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.