GD0-110 Investigator Practice Questions

3. An investigator needs to maintain the chain of custody. What is essential for this process?

• AA. Use flash drives
• BB. Store evidence in a drawer
• CC. Record all access details
• DD. Use multiple hard drives

5. During a hard drive analysis, the investigator encounters encrypted files. What is the rationale for attempting to decrypt them?

• AA. Encryption is illegal
• BB. They may contain evidence
• CC. They are not relevant
• DD. They can be deleted

6. In a scenario where a USB drive is found at a crime scene, what is the first action an investigator should take?

• AA. Secure it
• BB. Format the drive
• CC. Search for files
• DD. Analyze the drive

11. When analyzing a suspect's computer, what should an investigator do if they find malware?

• AA. Install antivirus software
• BB. Ignore it
• CC. Document and analyze it
• DD. Remove it immediately