GCC Class 1 Lesson 5 Quiz

What is the term we use to describe the priority, from high to low, for capturing data on an affected device?
A. Order of importance.
B. Computer forensics.
C. Order of volatility.
D. First-responder process.

When performing forensic testing and analysis, which version of a suspected system's data should you always use?
A. A printed copy of the contents of the captured data.
B. The original data, to ensure its accuracy.
C. A Filtered copy of the captured data.
D. An exact copy or data image.

What are the first objectives of a security incident first responder?
A. Question witnesses and create a chain of custody.
B. Identify the perpetrator and call law enforcement.
C. Document findings and the chain of custody.
D. Assess damage and control loss.

Which type of data typically requires special software or hardware tools to capture?
A. Encrypted data.
B. Archival data.
C. Active data.
D. Latent data.

To what list does forensic hashing compare the hash value of a document or file to determine if the file is unaffected?
A. LKGV.
B. KBF.
C. KFF.
D. KFC.