200-201 exam dumps: questions 201 to 300 of 403

Correct answers: A, C, E

• A. Correct.

  Documenting every transfer of the evidence is crucial to maintain an unbroken chain of custody and ensure the evidence's integrity and admissibility in legal proceedings.

• B. Incorrect.

  Encrypting the hard drive is not a standard chain of custody procedure and may alter the original state of the evidence, which could compromise its integrity.

• C. Correct.

  Storing the evidence in a secure, tamper-proof container protects it from unauthorized access or physical damage, which is essential for maintaining its integrity.

• D. Incorrect.

  Restricting access solely to one person is not a realistic or necessary requirement for chain of custody. Instead, proper documentation and secure handling procedures should be followed.

• E. Correct.

  Assigning a unique identifier to the evidence ensures it can be accurately tracked and identified throughout the investigation process, which is a fundamental part of chain of custody.

Correct answer: C

• A. Incorrect.

  Direct evidence is evidence that directly proves a fact without inference, such as a video recording of the event. This log entry does not meet that criterion.

• B. Incorrect.

  Best evidence refers to original, unaltered evidence, such as the original digital log file. While this entry may come from the original log, the type of evidence being referred to here is not categorized as 'best evidence' based on its context.

• C. Correct.

  Corroborative evidence supports or strengthens other evidence. In this scenario, the log entry provides corroborative details (e.g., failed login attempt, timestamp, and IP addresses) that could support an investigation or other findings.

• D. Incorrect.

  Indirect evidence requires inference to establish a fact. While the log entry provides information about the failed login attempt, it is more supportive in nature and not primarily inferred evidence.

Correct answer: A

• A. Correct.

  Authentication evidence is correct because this log entry records an authentication attempt (failed password) and includes details about the user, source IP, and access method (SSH).

• B. Incorrect.

  Network evidence is incorrect because while the log includes an IP address, the primary focus of the log is authentication, not network activity or traffic flow.

• C. Incorrect.

  File system evidence is incorrect because the log entry does not reference any files or interactions with the file system.

• D. Incorrect.

  Process evidence is incorrect because the log entry does not detail any specific processes or their states, even though it mentions the SSH daemon (sshd).

Correct answer: C

• A. Incorrect.

  Although an eyewitness account may provide valuable context, it is considered hearsay and not the most reliable or admissible form of evidence in a forensic investigation.

• B. Incorrect.

  A copy of system logs is secondary evidence since it is a duplicate of the original data and may not be admissible in court unless specific procedures are followed to prove its integrity.

• C. Correct.

  The original hard drive from the compromised server is considered 'best evidence' as it is the primary source of data. It is the most reliable and admissible form of evidence in forensic investigations, provided it is handled properly to maintain integrity.

• D. Incorrect.

  Screenshots may be useful for visualization or documentation purposes but are not considered 'best evidence' as they can be easily altered or manipulated.

Correct answer: D

• A. Incorrect.

  While memory (RAM) contents can provide valuable information, they are volatile and do not retain data after a system shutdown, making them less reliable as 'best evidence.'

• B. Incorrect.

  Log files are useful for tracking actions or events but can be altered or incomplete, making them less definitive than physical evidence.

• C. Incorrect.

  Screenshots provide visual documentation but are not considered 'best evidence' due to the inability to verify or analyze them further.

• D. Correct.

  The physical hard drive is considered the 'best evidence' because it contains persistent data that can be forensically analyzed to reconstruct events and verify findings.