How many Computer Forensics Lab practice questions does Courseiva have?

Courseiva has 9 Computer Forensics Lab practice questions for the CHFI exam.

What is the best way to practise Computer Forensics Lab questions?

Start with a short focused session to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.

Can I practise only Computer Forensics Lab questions?

Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.

CHFI · domain

Computer Forensics Lab

The Computer Forensics Lab domain covers how a lab is planned, secured, and operated so evidence stays admissible. CHFI tests physical security, chain of custody, network design for acquisition integrity, and the essential lab components, usually as scenario questions asking which control or practice comes first or matters most.

9 questions2 easy4 medium3 hard

Start practice test All Computer Hacking Forensic Investigator CHFI questions →

Focused practice

Practice Computer Forensics Lab questions

Scored sessions drawing only from this domain — pick a length below.

What this domain covers

What to know about Computer Forensics Lab

You must be able to select the correct lab control for a scenario: secure physical access first, document chain of custody at every transfer, isolate acquisition networks, and identify core lab components. The single most important thing is preserving evidence integrity and admissibility.

Physical access controls: locks, restricted entry, visitor logs, and surveillance protecting the lab first

Chain of custody documentation: evidence tags, transfer logs, and signed receipts for every handler

Isolated network design with segmented or air-gapped forensic subnets to prevent evidence contamination

Essential lab components: forensic workstations, write blockers, evidence storage, and validated imaging tools

Watch out for

Common Computer Forensics Lab exam traps

▸Choosing network or software controls before physical access security, when physical protection is the foundational first step
▸Treating chain of custody as a form only, forgetting continuous documentation from seizure through return or destruction
▸Connecting acquisition systems to production networks, letting malware or remote access alter evidence integrity

Question index

All Computer Forensics Lab questions (9)

Click any question to see the full explanation, or start a practice session above.

A forensic lab manager is setting up a new lab and must decide on the physical security measures. Which of the following is the MOST important to implement first?

Medium 2

A forensic lab in a shared office building must protect evidence against unauthorized physical access, environmental damage, and electromagnetic interference. The lab manager is documenting the physical controls for an accreditation audit. Which control best addresses the risk of an intruder removing a seized hard drive from the evidence room?

Medium 3

A forensic lab receives a sealed evidence bag containing a laptop seized during an investigation. The chain-of-custody form shows the bag was sealed at the scene by an officer. Before beginning analysis, the examiner must document the evidence. Which action best preserves the chain of custody at this point?

Hard 4

A forensics lab is preparing a new acquisition workstation for imaging suspect drives. The lab manager wants to ensure the workstation itself does not introduce evidence contamination or alter suspect media during imaging. Which two practices should be implemented? (Choose two.)

Medium 5

A junior examiner is preparing a forensics lab workstation that will be used to image suspect drives. The lab policy states the workstation must never write to a connected suspect drive. Which practice ensures this requirement is met?

Easy 6

A forensic lab is establishing a chain of custody procedure. Which practice is considered best according to CHFI guidelines?

Medium 7

You are a forensic examiner at a corporate security firm. You receive a laptop from the HR department that belonged to a terminated employee. The laptop was used for company business and is suspected of containing unauthorized file-sharing software. The laptop is running Windows 10 with BitLocker drive encryption enabled. Before shutdown, the employee was logged into the system. HR claims the laptop was shut down properly and then handed over within an hour. You are asked to acquire a forensic image of the hard drive for analysis. However, when you boot the laptop, you are prompted for the BitLocker recovery key. HR does not have the key, and the employee refuses to cooperate. The laptop also has a TPM chip. Which of the following is the most appropriate course of action to acquire the data?

Easy 8

A forensic lab is designing a network architecture to ensure the integrity of evidence during acquisition. What is the most critical design consideration?

Hard 9

Which TWO of the following are essential components of a computer forensics lab according to CHFI best practices?

Hard

Frequently asked questions

What does the Computer Forensics Lab domain cover on the CHFI exam?: You must be able to select the correct lab control for a scenario: secure physical access first, document chain of custody at every transfer, isolate acquisition networks, and identify core lab components. The single most important thing is preserving evidence integrity and admissibility.
How many questions are in this domain?: This page lists all 9 Computer Forensics Lab questions in the CHFI question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
What is the best way to practise this domain?: Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
Can I practise only Computer Forensics Lab questions?: Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.

Practice 25 questions