CCNA Chfi Fundamentals Process Questions — Page 3 of 3

151

MCQeasy

Which of the following best describes the 'Best Evidence Rule' as it applies to digital evidence?

A.A forensic image is considered the best evidence if the original is unavailable

B.Hearsay evidence is admissible if it is the only evidence available

C.The original digital media must be presented in court

D.Oral testimony is always better than written records

AnswerA

Courts accept a properly authenticated image as a duplicate of the original.

Why this answer

The Best Evidence Rule requires that the original evidence be presented, but in digital forensics, a forensic image is considered the best evidence if the original is not practical.

Practice this question →

152

MCQmedium

A forensic analyst is testifying in court as an expert witness. What is the PRIMARY role of an expert witness in digital forensics?

A.To represent the interests of the party that hired them.

B.To determine the guilt or innocence of the defendant.

C.To offer an opinion on the technical facts and assist the trier of fact.

D.To present factual findings only, without interpretation.

AnswerC

Expert witnesses provide interpretations and opinions within their expertise.

Why this answer

Option C is correct because the primary role of an expert witness in digital forensics is to provide an impartial opinion on technical facts, helping the trier of fact (judge or jury) understand complex digital evidence. Unlike a lay witness, an expert is permitted to offer interpretations and conclusions based on their specialized knowledge, as defined under Federal Rule of Evidence 702. This opinion must be based on sufficient facts or data, reliable principles and methods, and a reliable application of those methods to the case.

Exam trap

Cisco often tests the distinction between a fact witness and an expert witness, trapping candidates who think an expert can only present raw facts (Option D) rather than offering technical opinions.

How to eliminate wrong answers

Option A is wrong because an expert witness must remain impartial and objective, not advocate for the hiring party; their duty is to the court, not to the client. Option B is wrong because determining guilt or innocence is the sole responsibility of the trier of fact (judge or jury), not the expert witness, who only provides technical analysis and opinions. Option D is wrong because while factual findings are foundational, an expert witness is specifically allowed to offer interpretations and opinions on those facts, which is what distinguishes them from a fact witness.

Practice this question →

153

Multi-Selectmedium

Which TWO of the following are essential components of the rules of evidence for digital evidence to be admissible in court? (Choose two.)

Select 2 answers

A.Authenticity

B.Originality

C.Expediency

D.Admissibility

E.Complexity

AnswersA, D

Evidence must be genuine and unaltered.

Why this answer

Authenticity is a core component of the rules of evidence because it requires the proponent to show that the digital evidence is what it claims to be and has not been tampered with. For digital evidence, this is typically established through cryptographic hash verification (e.g., SHA-256) and a documented chain of custody. Without authenticity, the court cannot rely on the evidence's integrity, making it inadmissible.

Exam trap

EC-Council often tests the misconception that 'originality' is required for digital evidence, but the rule actually allows authenticated duplicates (e.g., forensic images) as long as the hash matches the original, making 'Originality' a distractor for those who confuse physical evidence rules with digital evidence rules.

Practice this question →

154

Multi-Selectmedium

Which TWO of the following are legal frameworks or regulations that govern search and seizure of digital evidence in the United Kingdom?

Select 2 answers

A.Computer Fraud and Abuse Act (CFAA)

B.Fourth Amendment to the US Constitution

C.PACE (Police and Criminal Evidence Act)

D.GDPR (General Data Protection Regulation)

E.Sarbanes-Oxley Act (SOX)

AnswersC, D

PACE sets out the legal framework for police powers, including search and seizure of evidence.

Why this answer

PACE and GDPR are relevant legal frameworks. PACE governs police powers, and GDPR regulates data protection and processing of personal data.

Practice this question →

155

MCQmedium

During a forensic examination, the analyst encounters a file that is not automatically readable by forensic tools. The analyst suspects the file contains contraband images. Which of the following is the BEST approach to handle this evidence in accordance with the rules of evidence?

A.Delete the file to prevent accidental distribution.

B.Create a forensic copy and use a write blocker to access the copy with appropriate software.

C.Ignore the file because it cannot be easily read.

D.Open the file using the original application on the suspect's computer.

AnswerB

Working on a copy preserves the original.

Why this answer

The analyst should document the file's location and metadata, then use a validated tool to extract and view the content while maintaining a chain of custody and ensuring the original is not altered.

Practice this question →